Dream: a chained PHP2Shell exploit rooted 25 servers

01What happened

Dream Research published its analysis on October 26, 2026, a day after recovering the operator's own files. The activity started on October 8, the first government-affiliated firewall was rooted on October 23, and the internal firewall management server was reached through a tunnel on October 24. Dream names no threat actor and says the outcome of the follow-on Active Directory attacks is unknown.

02How it works

A custom, non-public PHP2Shell build (CVE-2026-109618 and CVE-2026-109619) gave unauthenticated code execution as the nobody user, then Fragnesia (CVE-2026-46300), an XFRM ESP-in-TCP kernel flaw, overwrote /etc/pam.d/su to reach root. A reverse SSH tunnel kept by a systemd service and an rc.local hook held access across reboots. Target selection ran through the FOFA search service, narrowing roughly 19,000 exposed firewall management interfaces down to 240 hosts on the exploitable PHP branch.

03Who is affected

Internet-exposed firewall management interfaces running the affected PHP branch were the entry point. Dream withholds the firewall vendor and versions and says the vendor has been notified, so there is no product name to match on yet. Targeting covered the United States, Japan, Taiwan and South Korea, and the confirmed victim environment was US government-affiliated, with Keycloak single sign-on, GitLab, VPN gateways and an Active Directory domain.

04What to do

Patch PHP, and the firewall product once its vendor publishes guidance, then take management interfaces off the public internet. Hunt for the artifacts Dream lists, including unexpected reverse SSH tunnels held by systemd or rc.local, changes to /etc/pam.d/su, a small PHP webshell in a web-readable directory, and LDAP enumeration or password spraying that starts from a firewall or management host.

Questions people ask

Was the PHP2Shell firewall campaign carried out by AI?

Dream Research says no direct evidence shows AI tools wrote the exploit or the post-exploitation scripts. The assessment rests on code structure, commenting style and consistency across about 40 scripts, plus a Claude Code install and an aiscan deployment found in the operator's infrastructure. Dream states the operation does not appear to be a fully autonomous nation-state attack, so treat the AI link as inference.

Which firewall product was rooted in the Dream PHP2Shell campaign?

Dream Research withholds the firewall vendor and the affected versions, saying the vendor has been notified. Defenders therefore cannot match on a product name yet. The practical filter is exposure plus PHP version: Dream's operator used FOFA to find management interfaces reachable from the internet, then kept only hosts on the exploitable PHP 8.0.30 branch.

How does this differ from the earlier PHP2Shell disclosure?

The October 21 disclosure covered the PHP flaws themselves, which Wiz found with AI assistance. Dream Research's report covers a separate event: a live intrusion set that chained those flaws with a Linux kernel privilege escalation against exposed firewalls. Wiz reported seeing exploitation attempts but no completed public exploit chain, while Dream documents 25 hosts rooted with a custom, non-public build.

Sources 3 links, all fetched

1. 1dreamgroup.comDream Research Report
2. 2wiz.ioWiz Exploitation Data
3. 3github.comPHP Source Advisory