AI-Powered PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government Network

A suspected China-nexus threat actor attacked firewall systems across the U.S., Japan, Taiwan, and South Korea using a custom, non-public variant of the PHP2Shell vulnerability (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) combined with a Linux kernel privilege escalation exploit called Fragnesia (CVE-2026-46300, CVSS 7.8). The campaign rooted 25 servers total, including three belonging to a U.S. government-affiliated organization. The exploit targeted the PHP session.upload_progress mechanism on firewalls running PHP 8.0.30 with high memory limits, which enabled the memory corruption stages of the attack.

The attacker began by using FOFA to identify approximately 19,000 internet-facing firewalls with exposed management interfaces worldwide. A custom scanner filtered these to 5,000 devices with accessible version information, then narrowed further to 240 targets in the specified countries running the vulnerable PHP version. An automated batch runner exploited the PHP2Shell-Fragnesia chain, successfully rooting 24 servers. Two of these belonged to the government-affiliated organization; one crashed on October 23, 2026, shortly after compromise. The attacker then conducted additional campaigns, establishing a persistent reverse SSH tunnel through one compromised firewall to access the internal network and compromise a third government system on October 24, 2026, reaching a total of 25 rooted servers.

Evidence indicates AI-assisted development played a role in the attack. Researchers discovered Anthropic’s Claude Code installed in the attack infrastructure, along with API keys for FOFA and the aiscan platform configured with large language models from DeepSeek and Kimi. The code structure, commenting style, and consistency across nearly 40 scripts suggest the use of AI to augment the development process. After gaining access to the government network, the attacker targeted Active Directory to decrypt the LDAP service account password, enumerate users, and conduct password spraying using organization-themed credentials. The extent of the breach remains unclear, as it’s unknown whether valid credentials were obtained or backdoor accounts created. The attacker has retained access to approximately 19,000 fingerprinted targets, with 22 other compromised firewalls retaining active web shells.