PHP2Shell chain rooted firewalls and exposed managed fleets
Dream reported that a suspected China-nexus operation exploited 25 internet-facing firewalls on October 23–24, dropping root webshells on 24. Dream has not attributed the activity to a specific actor.
The attackers used FOFA to find 19,000 firewalls, then filtered by region and PHP version to a pool of 240 before chaining two PHP flaws with a Linux kernel privilege-escalation bug. That narrowed search let them reserve the full exploit chain for selected devices.
At a US government-affiliated organization, Dream says attackers used a rooted firewall and a reverse SSH tunnel to reach an internal firewall-management server. They obtained configurations and credentials for every firewall it managed, then accessed an LDAP service-account password, enumerated the domain, password-sprayed accounts and attempted to create Active Directory backdoors. If a central manager holds fleet credentials, an edge compromise can become a directory incident; Dream does not say whether the backdoor attempts succeeded.
CVSS 7.8 HIGH: in the Linux kernel, the following vulnerability has been resolved:
net: skbuff: preserve shared-frag marker during coalescing
skb_try_coalesce() can attach paged frags from @from to @to. EPSS 10% (96th percentile). Microsoft patch: CBL-Mariner Releases.
CVSS 9.8 CRITICAL: pHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. EPSS 100% (100th percentile).