# PHP2Shell Attack Roots 25 Servers, Three in a U.S. Government Network

- URL: https://usa-24.com/php2shell-vulnerability-fix/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-30T02:25:49.398Z
- Updated: 2026-10-30T02:25:49.407Z
- Topics: PHP2Shell, Linux Kernel, CISA, Vulnerability Management, Firewall Security

> A suspected China-nexus group rooted 25 servers using PHP2Shell and a Linux kernel flaw, and three of them sat in a U.S. government-affiliated network. The federal patch deadline is today.

## Key takeaways

- Researchers linked a PHP2Shell and Fragnesia exploit chain to root access on 25 servers, including three in a U.S. government-affiliated environment.
- The PHP2Shell pair, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS score of 9.2, and fixed PHP releases shipped October 21.
- CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26, and federal civilian agencies must patch by October 29.
- Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, and retire end-of-life 7.4, 8.0 and 8.1 branches.
- Patching may not clean a host that was already breached, so check logs for signs of compromise and restrict firewall admin pages to internal networks.

A suspected China-nexus group rooted 25 servers by chaining a PHP flaw with a Linux kernel bug, and three of the compromised machines sat inside a U.S. government-affiliated environment. [Dream Group](https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers) disclosed the campaign, which outlets widely covered on October 28, one day before the federal deadline for the PHP2Shell vulnerability fix. Federal civilian agencies must have their patches in place today.

This story follows our earlier reporting on [CISA's order to federal agencies to fix the PHP2Shell flaws](https://usa-24.com/php2shell-cve-2026-109618-patch/). What changed is the breach. New reporting ties the flaws to an intrusion into a government-affiliated network, which raises the stakes for every operator who has been waiting on a fix.

The attackers paired a custom PHP2Shell exploit with Fragnesia, a Linux kernel flaw tracked as CVE-2026-46300 and scored 7.8 on CVSS, to gain root on target systems. According to [The Hacker News](https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html), the operator focused on three servers in the government-affiliated environment and targeted Active Directory. [Pentasecurity](https://www.pentasecurity.com/blog/php2shell-attack-roots-25-servers-including-u-s-japan-taiwan-and-south-korea/) reported that the 25 rooted servers span the United States, Japan, Taiwan and South Korea.

## Is my PHP server vulnerable to PHP2Shell

The two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS score of 9.2. They affect PHP execution environments including Apache mod_php, PHP-FPM and LiteSpeed. CISA considers mod_php to carry particularly high risk, so Apache servers running mod_php belong at the top of the list.

Exposure is wide. Censys estimates that more than 32.51 million PHP services run on affected builds. PHP powers a large share of the web, so most administrators will need to check more than one machine.

Start with the version. Run `php -v` on each server, then confirm what the web server actually loads, because the command-line binary and the module serving web traffic can be different builds. Any build older than the fixed releases listed below counts as exposed.

Attackers appear to hunt by version, too. [Aviatrix Threat Research](https://aviatrix.ai/threat-research-center/php2shell-attack-roots-25-servers-cve-2026-109618-us-government-breach/) says the operator scanned roughly 19,000 internet-facing firewall management interfaces and narrowed the list to 240 systems running PHP 8.0.30. That figure comes from a single source, so read it as a signal of method rather than a verified count.

Exploit traffic is already visible. A lab at Delft University reported more than 50,000 PHP2Shell exploitation requests from over 600 IP addresses in 70 countries, according to [CompilanceHub's summary](https://compliancehub.wiki/php2shell-hits-cisa-kev-patch-deadlines-evidence-auditors-ask/).

## How the attack chained PHP2Shell with Fragnesia

The entry point was not a typical web request. Researchers said the operator used firewall management interfaces as the way in, then used the PHP exploit and the kernel flaw to reach root. After compromise, the attacker kept a persistent reverse SSH tunnel open, according to [Aviatrix](https://aviatrix.ai/threat-research-center/php2shell-attack-roots-25-servers-cve-2026-109618-us-government-breach/). A tunnel like that means a web-side fix alone does not end the attacker's access.

Dream Group also reported signs of artificial intelligence in the attack infrastructure. The company found an installed copy of Claude Code and an offensive-security platform configured with DeepSeek and Kimi models. It did not find direct proof that AI wrote the exploit. Its written report says: "While we have no direct evidence that the AI tools were specifically used to write the exploit."

Dream describes its evidence as circumstantial, so the AI role remains disputed. The more practical lesson concerns deployment. PHP shipped its fixes on October 21, and CISA listed the flaws five days later. A fix existed before the federal spotlight arrived, so the gap lies in how quickly administrators roll updates out.

## What the October 29 CISA deadline means

CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26, 2026, citing evidence of exploitation, according to [Cyber Insider](https://cyberinsider.co.uk/cisa-formally-lists-both-php2shell-flaws-as-exploited/). [Hackread](https://hackread.com/cisa-confirm-php2shell-exploit-federal-agencies-patch/) also covered the federal patch order. Binding Operational Directive 26-04 sets today's deadline for U.S. federal civilian agencies. For everyone else, the date is advisory.

The deadline does not explain what happened. CISA has not named the compromised organizations or described the attacks behind its decision, as [Mend's analysis on Security Boulevard](https://securityboulevard.com/2026/10/php2shell-is-in-cisa-kev-why-runtime-visibility-matters/) notes. Firewall and appliance vendors that bundle PHP carry risk too, according to a [BigGo Finance summary](https://finance.biggo.com/news/1e3d83db-9ad9-4755-9a85-47949df77254) of the listing.

## PHP2Shell vulnerability fix: versions to install

The fixed releases shipped on October 21. Match your installed branch to the fixed release in this table.

| PHP branch | Fixed release |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |

Installs on other branches need a different answer. [SOCRadar's affected-versions guide](https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/) recommends retiring end-of-life branches such as 7.4, 8.0 and 8.1 rather than trying to patch them. Note that 8.0 is the branch the attackers were hunting, specifically PHP 8.0.30.

## Steps to take today on PHP servers and firewalls

- Inventory every PHP runtime, including Apache mod_php, PHP-FPM and LiteSpeed deployments, and record the exact version of each.
- Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Move any 7.4, 8.0 or 8.1 install to a supported branch.
- Remove internet exposure of firewall admin pages, or restrict them to an internal management network. [Siteguarding](https://www.siteguarding.com/security-blog/palo-alto-php2shell-management-interface/) recommends this step for exposed management interfaces.
- Search logs for root activity you cannot explain, new outbound SSH sessions, reverse tunnels and unfamiliar accounts.
- Treat any host with evidence of compromise as breached. Patching alone may not clean a system that was already compromised, so investigate before returning it to service.
- Check your Linux distribution's advisories for Fragnesia. The fixed kernel versions are not confirmed in the sources we reviewed, so a PHP update does not cover the kernel flaw.

## What is still unknown about the breach

Several basic facts remain open. The government-affiliated entity is not named in the reporting we reviewed.

The firewall vendor is not confirmed either. Siteguarding's analysis points toward Palo Alto, but that link is an inference, not a stated finding. Edge devices from any vendor draw repeated attention, and ransomware gangs have already exploited a [Palo Alto GlobalProtect VPN flaw patched in May](https://usa-24.com/palo-alto-globalprotect-vulnerability-ransomware/).

Attribution stops at "suspected China-nexus," and no threat group has been named. Dates also disagree. Dream's blog says researchers uncovered the activity on October 25. One outlet says the 25 servers were rooted by October 24, and another reports the disclosure on October 26. Wide coverage arrived on October 28.

The Fragnesia timeline is murky too. One source cites an October 31 CISA deadline for the kernel flaw, but we could not confirm that date elsewhere. Treat it as unverified until CISA or a second source confirms it.

## What to watch next

The first thing to watch is whether CISA names the affected organizations or publishes more detail about the attacks behind its listing. Until then, administrators are working from researcher and vendor reports.

Second, watch Linux distributions for Fragnesia fixes and any deadline CISA sets for the kernel flaw. Firewalls have been a favored target, as in our coverage of [k0t's theft of 70,000 credentials from VPN and firewall devices](https://usa-24.com/k0t-fortigate-credentials-theft/), and this campaign follows the same path into management interfaces.

Third, both Censys's 32.51 million services and the Delft count of 50,000 exploitation requests describe a large target set. CISA has flagged a similar patch gap before, with the Node2Shell Brotli flaw in Node.js. The next signal will come from how quickly Fragnesia fixes reach production and whether CISA's silence about the victims lifts.

## Frequently asked questions

### Is my PHP server vulnerable to PHP2Shell?

Any PHP server running an affected build is exposed, including setups that use Apache mod_php, PHP-FPM or LiteSpeed. Run php -v to check the installed version and compare it with the fixed releases. CISA considers mod_php to carry particularly high risk.

### Which PHP version fixes PHP2Shell?

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released October 21, 2026. SOCRadar recommends retiring end-of-life branches such as 7.4, 8.0 and 8.1 instead of patching them. One analysis says the attackers were scanning for systems running PHP 8.0.30.

### Does the October 29 deadline apply to me?

The deadline under Binding Operational Directive 26-04 applies only to U.S. federal civilian agencies. For everyone else it is advisory, but the exploitation evidence applies to every operator running exposed PHP. Treat the date as a practical cutoff for your own patching.

### What is Fragnesia, CVE-2026-46300?

Fragnesia is a Linux kernel flaw that researchers said was chained with PHP2Shell to gain root access. It carries a CVSS score of 7.8. The fixed kernel versions are not confirmed in the sources reviewed, so check your distribution's security advisories.

## Sources

1. [PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network — The Hacker News](https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html)
2. [Chained PHP2Shell Exploit Roots 25 Servers, including US Government Servers — Dream Group](https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers)
3. [CISA Confirms PHP2Shell Exploitation, Orders Federal Agencies to Patch — Hackread](https://hackread.com/cisa-confirm-php2shell-exploit-federal-agencies-patch/)
4. [CISA formally lists both PHP2Shell flaws as exploited — Cyber Insider](https://cyberinsider.co.uk/cisa-formally-lists-both-php2shell-flaws-as-exploited/)
5. [PHP2Shell CVE-2026-109618 & 109619: Affected Versions & Fix — SOCRadar](https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/)
6. [PHP2Shell CVE-2026-109618 Attack Roots 25 Servers — Aviatrix Threat Research](https://aviatrix.ai/threat-research-center/php2shell-attack-roots-25-servers-cve-2026-109618-us-government-breach/)
7. [PHP2Shell Attack Roots 25 Servers Including U.S., Japan, Taiwan, and South Korea — Pentasecurity](https://www.pentasecurity.com/blog/php2shell-attack-roots-25-servers-including-u-s-japan-taiwan-and-south-korea/)
8. [Palo Alto PHP2Shell Attacks Hit Exposed Firewall Admin Pages — Siteguarding](https://www.siteguarding.com/security-blog/palo-alto-php2shell-management-interface/)
9. [US CISA Adds Two PHP Vulnerabilities to Known Exploited List, Orders Federal Agencies to Patch by October 29 — BigGo Finance](https://finance.biggo.com/news/1e3d83db-9ad9-4755-9a85-47949df77254)
10. [PHP2Shell is in CISA KEV: why runtime visibility matters — Security Boulevard (Mend)](https://securityboulevard.com/2026/10/php2shell-is-in-cisa-kev-why-runtime-visibility-matters/)
11. [PHP2Shell CISA KEV Deadlines: What Auditors Will Ask — CompilanceHub](https://compliancehub.wiki/php2shell-hits-cisa-kev-patch-deadlines-evidence-auditors-ask/)