Vulnerabilities · 5h ago
Dream reported that a suspected China-nexus operation exploited 25 internet-facing firewalls on October 23–24, dropping root webshells on 24. Dream has not attributed the activity to a specific actor.
The attackers used FOFA to find 19,000 firewalls, then filtered by region and PHP version to a pool of 240 before chaining two PHP flaws with a Linux kernel privilege-escalation bug. That narrowed search let them reserve the full exploit chain for selected devices.
At a US government-affiliated organization, Dream says attackers used a rooted firewall and a reverse SSH tunnel to reach an internal firewall-management server. They obtained configurations and credentials for every firewall it managed, then accessed an LDAP service-account password, enumerated the domain, password-sprayed accounts and attempted to create Active Directory backdoors. If a central manager holds fleet credentials, an edge compromise can become a directory incident; Dream does not say whether the backdoor attempts succeeded.
Known exploited · CISA KEV
CVSS 7.8 HIGH: in the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. EPSS 10% (96th percentile). Microsoft patch: CBL-Mariner Releases.
CISA federal remediation date Oct 31
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: pHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. EPSS 100% (100th percentile).
CISA federal remediation date Oct 29
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: pHP has various global state that temporarily points into request memory. EPSS 100% (100th percentile).
CISA federal remediation date Oct 29
2 sources covering this story
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
A suspected China-linked actor used an AI-assisted PHP2Shell exploit chain to root 25 servers and target Active Directory in a U.S.
China-Linked Hackers Exploit PHP2Shell to Root Firewalls
The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization.
Part of the PlainSec briefing for 2026-10-28