Dream Reports PHP2Shell Attack Chain That Compromised 25 Servers

Dream has reported a PHP2Shell attack chain that it says compromised 25 servers, including systems in a U.S. government-affiliated environment. Its October 26 investigation describes an exposed firewall management interface becoming a route toward internal identity infrastructure.

The reported total comprises 24 perimeter firewalls and one internal management server. Dream withheld the affected vendor and software versions and said it notified the vendor.

How the Exploit Chain Crossed Two Security Boundaries

The chain paired PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, with the Linux privilege-escalation vulnerability Fragnesia, CVE-2026-46300.

These vulnerabilities address different barriers. Remote code execution gives an attacker a way to run code through a reachable service. Local privilege escalation can then turn a restricted foothold into control over the operating system. Combining them changes the incident response problem: investigators must consider what the compromised appliance could access beyond its own management interface.

Red Hat describes Fragnesia as a flaw in the Linux kernel’s XFRM ESP-in-TCP subsystem. Unsafe cryptographic processing can let a low-privileged local attacker alter the page cache of read-only files, overwrite privileged binaries, and obtain root privileges. It is therefore a distinct escalation mechanism, rather than the initial unauthenticated entry point.

Dream confirmed extraction of an LDAP service-account credential and directory enumeration. It could not establish whether password spraying, attempted backdoor-account creation, or SAML signing-key extraction succeeded. Those limits matter: confirmed access to directory information does not establish a complete takeover of Active Directory.

What the AI Evidence Establishes

Investigators found Claude Code installed and an offensive platform configured with DeepSeek and Kimi. Dream said it had no direct evidence that these tools wrote the exploit or post-exploitation scripts and did not characterize the operation as fully autonomous. Its suggested Chinese nexus is tentative; it named no threat actor.

For defenders, that distinction separates observable tooling from conclusions about authorship, operator identity, or autonomy. The presence of a coding assistant can support a hypothesis about workflow, but it cannot by itself establish which decisions a model made or who directed the operation.

The PHP Fixes and the Earlier Exploitation Window

The PHP project’s October 21 advisory identifies PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as the security releases fixing the two critical remote-code-execution vulnerabilities. One involves out-of-memory handling leaving internal request data partially initialized; the other involves stale internal state surviving after its backing memory has been freed.

The project warns that PHP installations serving web requests are at risk, with the highest assessed risk for Apache’s mod_php configuration. It says partial mitigations do not provide complete protection and directs users to update. For packaged appliances, the practical remediation route depends on the vendor’s supported firmware and backported fixes, rather than a runtime version string alone.

Unite.AI previously covered the PHP patches and the role of frontier AI in discovering the flaws. This new report shifts attention from discovery to the consequences of an exposed deployment.

Separately, Amazon Threat Intelligence reported PHP2Shell exploitation attempts in its MadPot honeypot network beginning October 17, before public disclosure. That telemetry does not establish that the same operator conducted the campaign Dream describes.

AWS recommends measuring mitigation timelines for critical internet-facing vulnerabilities in hours, investigating from the earliest known exploitation rather than the disclosure date, and developing detections that do not depend solely on a CVE-specific signature. For PHP2Shell, it recommends looking back at least to October 17.

Where Dream’s Technology Fits

On its company website, Dream positions Hero as an autonomous cyber-research system supporting vulnerability investigation, malware reverse engineering, forensic analysis, and validated fixes. Its complementary Sphere platform focuses on mapping exposure and prioritizing defense across government and critical-infrastructure environments.

The technical distinction is between investigating a particular weakness and understanding where it matters across an operational network. A perimeter appliance, its management server, and an identity directory may have different owners and patch cycles, yet an attacker can connect them into one path. Effective containment requires examining that path alongside installing the relevant updates.