PHP2Shell and Fragnesia: AI-Assisted Campaign Roots 25 Firewalls

Dream Research reports that a suspected China-nexus operator chained a custom PHP2Shell exploit with the Fragnesia Linux kernel exploit to root 25 servers, including three in a US government-affiliated network. The firm's write-up says it found the artifacts on October 25, 2026. Claude Code was installed on the attacker's infrastructure, but Dream says it has no direct evidence the AI tools wrote the exploits.

If you run PHP-based management interfaces, firewalls with web consoles, or Linux servers exposed to the internet, the action is the same as before: patch PHP, patch the kernel, and take management interfaces off the public internet. If you run coding agents, the lesson is about the other side of the table: attackers use the same tools you do, and the speed gap between disclosure and exploitation keeps shrinking.

TL;DR

What Dream says it found

Dream found a complete operation: a custom, non-public build of the PHP2Shell exploit for CVE-2026-109618 and CVE-2026-109619, the Fragnesia privilege escalation (CVE-2026-46300), target lists, exploitation logs, and about 40 custom post-exploitation scripts. The campaign touched servers in the United States, Japan, Taiwan and South Korea.

Dream does not name the firewall vendor or the vulnerable versions. It says the vendor has been notified. SecurityWeek's coverage adds that exploitation ran on October 23 and 24. The numbers differ slightly between outlets: Dream's own text says 24 firewalls were rooted in the automated batch, and the 25th server was an internal management server compromised later through a tunnel.

The attack chain, step by step

Step 1: PHP2Shell gives code execution as nobody

PHP2Shell is the pair of PHP flaws we covered in how PHP2Shell works. Dream says the recovered implementation targets PHP's session.upload_progress mechanism on the firewall's appweb management server, which ran PHP 8.0.30 with a high memory limit. The exploit runs in four stages:

1. A1, memory exhaustion (about 383 MB): crafted multipart POSTs with huge filenames and session progress data push PHP's allocator into a predictable layout.
2. B1, information leak: a request forges the stale session ID length, forcing an out-of-bounds read. The Set-Cookie header carries a pointer that reveals the base address of libphp.so.
3. A2, stale reference (about 500 MB): more memory pressure leaves http_session_vars as a live reference, then a second out-of-memory condition leaves mod_data=NULL.
4. B2, code execution: a forged PHP HashTable entry gets a destructor pointing at zif_system. When PHP cleans up, it runs the attacker's command as nobody.

Dream stresses this is not a copy of any public exploit. It appears tailored to the firewall platform.

Step 2: Fragnesia turns nobody into root

SELinux confines the web server process, so code execution as nobody was not enough. Dream says the attacker chained in Fragnesia, a Linux kernel flaw in the XFRM ESP-in-TCP subsystem. It uses page-cache writes to overwrite /etc/pam.d/su with rules that accept everyone (pam_permit.so). Because the file is 774 bytes, the exploit uses a per-byte splicing variant. After that, su root works without a password.

Both exploits run inside one B2 request. Dream says the chain goes from an unauthenticated HTTPS connection to a persistent root webshell in under 15 minutes.

Step 3: Per-version calibration in a lab

The exploit needs exact memory offsets. Dream found 11 JSON profile files, one per firmware version tested, with offsets extracted from each version's libphp.so, SHA256 hashes and ELF build IDs. One profile was fully lab-calibrated; the others were provisional, derived from the binary but not verified on a live instance. The attacker had obtained and decrypted the vendor's firmware to build these.

Step 4: The targeting funnel

For each success the runner planted a 103-byte PHP root webshell in a public directory, verified root with id, and logged the host. Twenty-two firewalls were then left alone, "owned and parked," in Dream's words.

Step 5: Pivot into a government-affiliated network

The first firewall of interest was rooted on October 23 at 18:14 UTC, then crashed, probably from roughly 900 MB of exploit traffic. The attacker probed it 240 times over two hours. A second firewall, linked to the same organization by certificate data, was rooted on October 24 at 10:09 UTC in a dedicated campaign.

Within hours, Dream says, the attacker:

• built an 8-port reverse SSH tunnel with a SOCKS5 proxy, wrapped in a systemd service and an rc.local hook so it survives reboots;
• used the tunnel at 11:35 UTC to run the same chain against the internal firewall management server, the machine that centrally manages the organization's firewalls;
• decrypted the LDAP service account password from the device configuration, enumerated users and groups, and sprayed passwords (the domain had lockoutThreshold=0);
• tried to create backdoor user and machine accounts, analyzed AD ACL paths, and tried to extract SAML signing keys from the Keycloak configuration.

Dream could not recover the results of the spray, the account creation or the key extraction, so it says it cannot determine the full extent of the compromise.

The AI angle: what is evidenced and what is inferred

This is the part to read carefully. Dream lists three observations on the attacker's infrastructure:

• Claude Code had been installed.
• An AI-powered offensive security platform called aiscan was configured with the Chinese models DeepSeek and Kimi, and its session logs contained Chinese-language prompts.
• API keys for FOFA were present.

Dream's own assessment: "we have no direct evidence that the AI tools were specifically used to write the exploit or the post-exploitation scripts," although code structure, comment style and consistency across about 40 scripts suggest AI-assisted development. It also says the operation "does not appear to be a fully autonomous nation-state attack."

Our reading, labelled as such: the presence of a coding agent on a staging box shows normal adoption, not necessarily misuse of any specific vendor's product. The campaign's technical difficulty (memory-corruption offsets for 11 per-version profiles) is the part that took human effort. AI plausibly helped with the glue: the version scanner, the batch runner and the AD scripts. That matches the pattern in Anthropic's September 2026 threat report, where agents act as orchestrators of human-directed work, and in AI-built exploit chains. For the broader argument on exploit speed, see PHP2Shell and AI agents.

Attribution is also soft. Dream names no actor. Its indicators are the four target countries, FOFA, the Chinese tunneling utility iox, the Chinese LLMs, UTC+8 timestamps and Chinese prompts. These are consistent with a Chinese-speaking operator but are not proof of a state sponsor.

What this means if you run AI coding agents

You are not the target of this campaign, but your environment shares its ingredients. Concrete checks:

1. Patch PHP everywhere it runs, including dev containers, CI images and local stacks. Check with php -v and compare against 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (the fixed versions reported for the October release). Our PHP2Shell patch guide has per-distribution commands. Note that PHP 8.1 and 7.4 are end of life, as covered in PHP end of life and PHP2Shell.
2. Update the kernel to a build that includes the Fragnesia (CVE-2026-46300) fix from your distribution, then reboot. Check with uname -r and your vendor's advisory.
3. Never expose a management interface to the internet. This was Dream's central point: a chain that starts with one unauthenticated HTTPS request to a console that should never have been public.
4. Hunt for the artifacts Dream lists: small PHP files in web-accessible directories, a changed /etc/pam.d/su, reverse SSH processes, new systemd units, edits to /etc/rc.local, and bursts of large multipart POSTs.
5. Harden Active Directory basics the attacker exploited: set an account lockout threshold, and reduce MachineAccountQuota where you can.
6. Rotate secrets on any host that was exposed and vulnerable, including API keys for model providers that sit in PHP process memory. Our October AI-led attacks roundup covers why those keys are a target.
7. Be careful letting an agent do emergency patching. Keep it to known commands and log what it runs.

What Beam can and cannot do here

Beam does not defend a firewall or a PHP server. It is local security and observability for coding agents on a developer machine. Where it applies: if you use an agent to apply patches or investigate a suspected compromise, Beam can record what the agent runs and flag risky actions such as credential exposure or destructive commands, and its PreToolUse hooks can deny them for Claude Code and Codex. That denial is hook-based, not a kernel sandbox, and the scanning is heuristic. Beam also does not detect webshells, tunnels or kernel exploits on remote servers. See how Beam works and what it watches.

What to watch next

Dream says the 22 parked firewalls and the tunnel into the government-affiliated network are likely still active, and that the attacker holds roughly 19,000 fingerprinted targets to revisit as new version profiles are built. Expect the vendor to publish an advisory. We track this on the October 2026 attacks timeline and will add a dated update here when the vendor or CISA says more. Dream's own report is the primary source for the campaign claims above; SecurityWeek's coverage is secondary.

Frequently asked questions

What did Dream Research find?

On October 25, 2026 Dream found artifacts of a campaign that chained a custom PHP2Shell exploit with the Fragnesia Linux kernel exploit to root 25 servers in the US, Japan, Taiwan and South Korea. Three were in a US government-affiliated environment. The firewall vendor and versions were not disclosed.

Did the attacker use Claude Code to build the exploit?

Not proven. Dream found Claude Code installed, plus an AI offensive platform called aiscan configured with DeepSeek and Kimi. It says it has no direct evidence these tools wrote the exploit or the roughly 40 post-exploitation scripts, though code style suggests AI assistance. It also says this does not look like a fully autonomous attack.

Which CVEs are involved?

PHP2Shell is CVE-2026-109618 and CVE-2026-109619, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 according to press coverage of the patch. Fragnesia is CVE-2026-46300, a Linux kernel flaw in the XFRM ESP-in-TCP subsystem.

How do I know if my firewall or server was hit?

Look for small PHP webshells in web-accessible directories, unexpected reverse SSH tunnels, systemd units or rc.local entries you did not add, a modified /etc/pam.d/su, and very large bursts of multipart POST requests to the management interface. Remove the management interface from the internet and patch.

Does this affect people who only run coding agents?

Not directly. It matters because it shows attackers installing coding agents on their own infrastructure, and because a developer machine or CI box running PHP or a vulnerable firewall is a normal target. Patch your stack and keep management interfaces off the internet.

Related reading

• PHP2Shell: how it works
• PHP2Shell patch guide for Ubuntu, Debian, RHEL and Docker
• PHP2Shell and AI agents
• Anthropic's September 2026 threat report
• October 2026 attacks timeline
• CVE pages: CVE-2026-109618 and CVE-2026-109619

Details reflect Dream Research's October 26, 2026 report and press coverage as of October 28, 2026. Facts about this campaign may change as the vendor and investigators publish more.