A single exposed firewall management interface was apparently enough to set off a chain reaction that ended with root access on two dozen systems, including machines inside a US government-affiliated network. Researchers at the threat-hunting firm Dream say they recovered a trove of attacker tooling on October 25, 2026, that lays out the entire operation step by step: custom exploit code, lists of targets, attack logs, and roughly 40 scripts meant to be run after a server was already compromised.

Two Bugs, One Fifteen-Minute Takeover

At the center of the campaign is a pairing the researchers call PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, combined with a Linux kernel privilege-escalation bug nicknamed Fragnesia and tracked as CVE-2026-46300. Unlike a copy-pasted public proof-of-concept, Dream describes the PHP2Shell code as a bespoke implementation built specifically for the targeted firewall vendor’s management software.

The attack abused PHP’s session.upload_progress feature inside the firewall’s web management server. By forcing the service to exhaust its own memory and leak a memory address, the attacker was able to corrupt internal data structures and run commands as a low-privilege account. From there, the Fragnesia kernel flaw rewrote local authentication records, handing the intruder a root shell without ever supplying a password. Investigators estimate the entire sequence, from first contact to an installed root webshell, took under 15 minutes.

Casting a Wide Net, Then Narrowing It

The attacker reportedly used the internet-scanning service FOFA to identify roughly 19,000 firewalls exposed to the public internet. Only about 5,000 of those revealed their software version, and after filtering by geography and version number, the target list shrank to 240 candidates. Of those, 24 firewalls across the United States, Japan, Taiwan, and South Korea were successfully compromised, with webshells planted on 22 of them. Dream found no evidence of further activity on most of those machines beyond the initial foothold.

A Deeper Push Into a Government Network

Two firewalls tied to a US government-affiliated organization drew more sustained attention. After an initial attempt caused one device to crash, the attacker returned on October 24 and successfully compromised a second firewall, this time setting up a reverse SSH tunnel that forwarded eight internal ports and was configured to survive a reboot. Through that tunnel, the same exploit chain was launched again, this time against an internal firewall management server reachable only from inside the network. That server became the 25th and final confirmed victim, exposing centrally managed configuration data and credentials for the organization’s wider fleet of firewalls.

Reaching Into Active Directory

From the compromised management server, the attacker decrypted a stored LDAP service-account password and used it to enumerate Active Directory users and groups. Dream’s analysis also turned up signs of attempted password spraying, creation of a backdoor account, and an attempt to steal a SAML signing key, though the researchers say it is not yet clear whether any of these follow-on efforts actually succeeded. That distinction matters for incident responders: compromising a firewall is not the same as confirming an attacker achieved domain-wide control, and the two should not be conflated when scoping a response.

Hints of a Chinese Connection, but No Firm Attribution

Among the recovered files, Dream found references to Claude Code and an AI-assisted scanning setup built around the DeepSeek and Kimi models, along with prompts written in Chinese and timestamps consistent with the UTC+8 time zone. Those details support a working theory that the operators may be based in China, but the researchers stop short of naming a specific group, and they found nothing proving that AI tools authored the exploit code itself or ran the operation autonomously.

What Organizations Should Do

The affected firewall vendor has been notified but has not been publicly named while a fix is prepared, so Dream’s guidance for now is generic but still useful:

• Treat internet-facing firewall management interfaces as high-value targets and restrict access to them wherever possible.
• Apply vendor patches as soon as they become available, rather than waiting for a named advisory.
• Assume that a compromised management appliance may have exposed stored credentials, and rotate them even after the entry point itself is patched.
• Audit Active Directory for new accounts, password-spray attempts, and signing-key access tied to the timeframe of any suspected compromise.

The underlying lesson, researchers emphasize, is that patching the initial vulnerability does not automatically answer the harder question of whether stolen credentials, tunnels, or webshells are still usable somewhere inside the network.