# PHP2Shell (CVE-2026-109618/CVE-2026-109619) + Fragnesia (CVE-2026-46300) Chain Roots 25 Servers, Breaches U.S. Government-Affiliated Network

> A suspected China-nexus operator chained the PHP2Shell unauthenticated RCE flaws with the Fragnesia Linux kernel LPE against internet-exposed firewall management interfaces, rooting 25 servers in the U.S., Japan, Taiwan and South Korea. The actor reached the internal network of a U.S. government-affiliated organization via root PHP web shells and an 8-port reverse SSH tunnel, then began Active Directory reconnaissance and password spraying.

- **Published:** 2026-10-29T00:02:56Z
- **Last reviewed:** 2026-10-29T00:02:56Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4686
- **ID:** TL-2026-4686
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-109618, CVE-2026-109619, CVE-2026-46300, CVE-2026-115560

## Description

Dream researchers recovered artifacts from attacker infrastructure showing a custom, non-public weaponization of PHP2Shell (CVE-2026-109618 and CVE-2026-109619) paired with Fragnesia (CVE-2026-46300) against the appweb management server of an undisclosed large firewall vendor. Targets ran PHP 8.0.30 (7.4.33 also appears in the artifacts) with SELinux httpd_t confinement. Dream does not attribute the activity to a named actor, but cites multiple China-nexus indicators: targeting limited to the U.S., Japan, Taiwan and South Korea, infrastructure on UTC+8, use of the FOFA search engine, the Chinese-developed iox tunneling tool, DeepSeek and Kimi LLM configurations, and Chinese-language prompts in aiscan logs.

PHP2Shell is a pair of memory-safety flaws disclosed and patched by the PHP project on 2026-10-21 (fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with backports for 7.4, 8.0 and 8.1). CVE-2026-109619 is a use-after-free (CWE-416) in the session.upload_progress feature, where cached zval pointers dangle after session hash tables are replaced. CVE-2026-109618 is memory corruption after an out-of-memory condition forces a longjmp that skips cleanup (CWE-400). Both are rated CVSS v4.0 9.2. Per Dream, the exploit ran in stages: memory exhaustion of about 383MB via a multipart POST with crafted filenames, an out-of-bounds read leaking the libphp.so base address through a Set-Cookie header, a stale-reference setup of about 500MB, and a forged HashTable whose pDestructor points to zif_system. This yielded command execution as the nobody user.

Privilege escalation used Fragnesia (CVE-2026-46300, CVSS 7.8), a Linux kernel XFRM ESP-in-TCP flaw disclosed on 2026-05-13 by William Bowling (V12 Security). skb_try_coalesce() fails to propagate SKBFL_SHARED_FRAG, allowing writes into the page cache of readable files. The actor used a per-byte page-cache write to replace /etc/pam.d/su (774 bytes) with a pam_permit.so configuration, then ran su root without a password. A 103-byte root PHP web shell was planted and verified with the id command. Persistence was a systemd service plus an rc.local boot hook, and an 8-port reverse SSH tunnel with a SOCKS5 proxy (iox is listed among the tools) gave access to the internal network.

The campaign funnel was about 19,000 firewalls found through FOFA, about 5,000 alive per a custom scanner (200 threads), 240 filtered targets (target countries, PHP 8.0.30), and 24 firewalls exploited. Of these, 22 were parked with web shells and 2 government targets were prioritized. One internal firewall management server was also rooted, giving 25 compromised servers in total. Eleven JSON version profiles held SHA256 hashes, ELF build IDs and exact memory offsets for each tested firewall OS version. About 40 custom post-exploitation scripts showed AI-assisted development, and Claude Code and aiscan (with DeepSeek and Kimi) were found on the infrastructure.

Post-compromise, from the management server the actor decrypted the LDAP service account password from the encrypted device config, enumerated users and groups, and sprayed passwords against all users (the domain had lockoutThreshold=0). The actor also attempted backdoor user creation in every OU and machine account creation via the default MachineAccountQuota, analyzed AD ACL chains, and probed Keycloak for SAML signing key extraction and authentication bypass. Outcomes of the spray, backdoor and key-extraction attempts were not recovered. Harvested material included HA replication keys, TLS certificate keys and device authentication keys. CISA added CVE-2026-109618 and CVE-2026-109619 to the KEV catalog on 2026-10-28 with a federal due date of 2026-10-29. No network IOCs (IPs, domains, hashes) were published in the sources reviewed, so none are listed.

## MITRE ATT&CK

- T1596.005 Scan Databases
- T1595.002 Vulnerability Scanning
- T1587.004 Exploits
- T1588.007 Artificial Intelligence
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1543.002 Systemd Service
- T1037.004 RC Scripts
- T1556.003 Pluggable Authentication Modules
- T1110.003 Password Spraying
- T1552 Unsecured Credentials
- T1087.002 Domain Account
- T1069.002 Domain Groups
- T1136.002 Domain Account
- T1572 Protocol Tunneling
- T1090 Proxy

## Sources

- [PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network](https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html)
- [Chained PHP2Shell Exploit Roots 25 Servers (Dream)](https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers)
- [PHP2Shell flaws exploited: CISA gives US agencies until Thursday](https://thenextweb.com/news/php2shell-flaws-exploited-cisa-kev)
- [Understanding PHP2Shell: Everything You Need to Know (Akamai)](https://www.akamai.com/blog/security-research/understanding-php2shell-everything-you-need-to-know)
- [PHP ships emergency patches for critical PHP2Shell flaws (BleepingComputer)](https://bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws)
- [The Register: PHP2Shell and third PHP CVE-2026-115560](https://www.theregister.com/a/5305208)
- [Fragnesia (CVE-2026-46300): FAQ about new Linux Kernel XFRM ESP-in-TCP priv esc (Tenable)](https://tenable.com/blog/fragnesia-cve-2026-46300-faq-about-new-linux-kernel-xfrm-esp-in-tcp-priv-esc)
- [Understanding PHP2Shell vulnerabilities and reducing risk while you patch (Fortinet)](https://www.fortinet.com/blog/industry-trends/understanding-php2shell-vulnerabilities-and-reducing-risk-while-you-patch)
- [Dream Reports PHP2Shell Attack Chain That Compromised 25 Servers (Unite.AI)](https://www.unite.ai/dream-reports-php2shell-attack-chain-that-compromised-25-servers/)
- [CISA Says PHP2Shell Flaw Under Attack as Reports of More Come In (Security Boulevard)](https://securityboulevard.com/2026/10/cisa-says-php2shell-flaw-under-attack-as-reports-of-more-come-in/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4686