PHP2Shell Attack Roots 25 Servers, Three in a U.S. Government Network

A suspected China-nexus group rooted 25 servers by chaining a PHP flaw with a Linux kernel bug, and three of the compromised machines sat inside a U.S. government-affiliated environment. Dream Group disclosed the campaign, which outlets widely covered on October 28, one day before the federal deadline for the PHP2Shell vulnerability fix. Federal civilian agencies must have their patches in place today.

This story follows our earlier reporting on CISA's order to federal agencies to fix the PHP2Shell flaws. What changed is the breach. New reporting ties the flaws to an intrusion into a government-affiliated network, which raises the stakes for every operator who has been waiting on a fix.

The attackers paired a custom PHP2Shell exploit with Fragnesia, a Linux kernel flaw tracked as CVE-2026-46300 and scored 7.8 on CVSS, to gain root on target systems. According to The Hacker News, the operator focused on three servers in the government-affiliated environment and targeted Active Directory. Pentasecurity reported that the 25 rooted servers span the United States, Japan, Taiwan and South Korea.

Is my PHP server vulnerable to PHP2Shell

The two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS score of 9.2. They affect PHP execution environments including Apache mod_php, PHP-FPM and LiteSpeed. CISA considers mod_php to carry particularly high risk, so Apache servers running mod_php belong at the top of the list.

Exposure is wide. Censys estimates that more than 32.51 million PHP services run on affected builds. PHP powers a large share of the web, so most administrators will need to check more than one machine.

Start with the version. Run php -v on each server, then confirm what the web server actually loads, because the command-line binary and the module serving web traffic can be different builds. Any build older than the fixed releases listed below counts as exposed.

Attackers appear to hunt by version, too. Aviatrix Threat Research says the operator scanned roughly 19,000 internet-facing firewall management interfaces and narrowed the list to 240 systems running PHP 8.0.30. That figure comes from a single source, so read it as a signal of method rather than a verified count.

Exploit traffic is already visible. A lab at Delft University reported more than 50,000 PHP2Shell exploitation requests from over 600 IP addresses in 70 countries, according to CompilanceHub's summary.

How the attack chained PHP2Shell with Fragnesia

The entry point was not a typical web request. Researchers said the operator used firewall management interfaces as the way in, then used the PHP exploit and the kernel flaw to reach root. After compromise, the attacker kept a persistent reverse SSH tunnel open, according to Aviatrix. A tunnel like that means a web-side fix alone does not end the attacker's access.

Dream Group also reported signs of artificial intelligence in the attack infrastructure. The company found an installed copy of Claude Code and an offensive-security platform configured with DeepSeek and Kimi models. It did not find direct proof that AI wrote the exploit. Its written report says: "While we have no direct evidence that the AI tools were specifically used to write the exploit."

Dream describes its evidence as circumstantial, so the AI role remains disputed. The more practical lesson concerns deployment. PHP shipped its fixes on October 21, and CISA listed the flaws five days later. A fix existed before the federal spotlight arrived, so the gap lies in how quickly administrators roll updates out.

What the October 29 CISA deadline means

CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26, 2026, citing evidence of exploitation, according to Cyber Insider. Hackread also covered the federal patch order. Binding Operational Directive 26-04 sets today's deadline for U.S. federal civilian agencies. For everyone else, the date is advisory.

The deadline does not explain what happened. CISA has not named the compromised organizations or described the attacks behind its decision, as Mend's analysis on Security Boulevard notes. Firewall and appliance vendors that bundle PHP carry risk too, according to a BigGo Finance summary of the listing.

PHP2Shell vulnerability fix: versions to install

The fixed releases shipped on October 21. Match your installed branch to the fixed release in this table.

Installs on other branches need a different answer. SOCRadar's affected-versions guide recommends retiring end-of-life branches such as 7.4, 8.0 and 8.1 rather than trying to patch them. Note that 8.0 is the branch the attackers were hunting, specifically PHP 8.0.30.

Steps to take today on PHP servers and firewalls

• Inventory every PHP runtime, including Apache mod_php, PHP-FPM and LiteSpeed deployments, and record the exact version of each.
• Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Move any 7.4, 8.0 or 8.1 install to a supported branch.
• Remove internet exposure of firewall admin pages, or restrict them to an internal management network. Siteguarding recommends this step for exposed management interfaces.
• Search logs for root activity you cannot explain, new outbound SSH sessions, reverse tunnels and unfamiliar accounts.
• Treat any host with evidence of compromise as breached. Patching alone may not clean a system that was already compromised, so investigate before returning it to service.
• Check your Linux distribution's advisories for Fragnesia. The fixed kernel versions are not confirmed in the sources we reviewed, so a PHP update does not cover the kernel flaw.

What is still unknown about the breach

Several basic facts remain open. The government-affiliated entity is not named in the reporting we reviewed.

The firewall vendor is not confirmed either. Siteguarding's analysis points toward Palo Alto, but that link is an inference, not a stated finding. Edge devices from any vendor draw repeated attention, and ransomware gangs have already exploited a Palo Alto GlobalProtect VPN flaw patched in May.

Attribution stops at "suspected China-nexus," and no threat group has been named. Dates also disagree. Dream's blog says researchers uncovered the activity on October 25. One outlet says the 25 servers were rooted by October 24, and another reports the disclosure on October 26. Wide coverage arrived on October 28.

The Fragnesia timeline is murky too. One source cites an October 31 CISA deadline for the kernel flaw, but we could not confirm that date elsewhere. Treat it as unverified until CISA or a second source confirms it.

What to watch next

The first thing to watch is whether CISA names the affected organizations or publishes more detail about the attacks behind its listing. Until then, administrators are working from researcher and vendor reports.

Second, watch Linux distributions for Fragnesia fixes and any deadline CISA sets for the kernel flaw. Firewalls have been a favored target, as in our coverage of k0t's theft of 70,000 credentials from VPN and firewall devices, and this campaign follows the same path into management interfaces.

Third, both Censys's 32.51 million services and the Delft count of 50,000 exploitation requests describe a large target set. CISA has flagged a similar patch gap before, with the Node2Shell Brotli flaw in Node.js. The next signal will come from how quickly Fragnesia fixes reach production and whether CISA's silence about the victims lifts.