Dream Research: PHP2Shell roots 25 servers

What the report says

Dream Research published a report on 26 October 2026 describing an automated campaign that combined the two PHP2Shell vulnerabilities with Fragnesia (CVE-2026-46300), a Linux kernel privilege-escalation flaw. The report says the chain gave the operator root on 25 servers: 24 perimeter firewalls and one internal management server.

Three of the compromised servers were in what the report calls a US government-affiliated environment. The original 26 October report withheld the firewall vendor. On 29 October, Dream updated the report to name Palo Alto Networks PAN-OS and said it was collaborating with Palo Alto Networks on the investigation.

Palo Alto Networks’ Unit 42 updated its own brief the same day, saying it independently verified the same attacker’s tooling and confirmed the reported results. Unit 42 does not itemize the 25 servers or name victims.

This is still a vendor investigation, not an official victim announcement. CISA added both PHP2Shell CVEs to KEV on 26 October, but the KEV entry does not describe this campaign, name these victims or confirm the 25-server count.

How the campaign reached root

The report describes a funnel that started with exposed appliances:

• FOFA was used to identify about 19,000 internet-facing firewalls from one vendor.
• A scanner with 200 concurrent threads fingerprinted about 5,000 live devices.
• Filtering to the US, Japan, Taiwan and South Korea, and to versions matching the exploit profiles, produced 240 targets.
• An automated batch runner attacked five targets at a time and rooted 24 firewalls.

The first government-linked firewall was rooted on 23 October, according to the report, then crashed and did not recover. A second was rooted on 24 October, and the internal management server was reached through a tunnel less than 90 minutes later.

PHP2Shell provided code execution as the nobody user. Fragnesia was then used to overwrite /etc/pam.d/su, allowing passwordless su root. The operators left a 103-byte PHP webshell and verified root with id. The report also describes an eight-port reverse SSH tunnel, a systemd service and an rc.local hook used for persistence.

Dream described the recovered PHP2Shell implementation as a custom, non-public build tailored to the targeted firewall platform and its PHP 8.0.30 runtime, not a copy of a known public exploit. That claim comes from the vendor’s analysis of recovered artifacts and has not been independently tested.

CISA later added Fragnesia, CVE-2026-46300, to KEV on 28 October 2026, with a due date of 31 October. That listing covers the privilege-escalation flaw, not the PHP2Shell CVEs. It is a determination of known exploitation, not a victim count.

What is confirmed and what is not

The report says recovered artifacts confirm root on the 25 servers, the reverse SSH tunnel, the persistence mechanisms, decryption of an LDAP service-account password, Active Directory user and group enumeration, and theft of private keys and network topology.

It explicitly does not establish that password spraying succeeded, that backdoor user or machine accounts were created, or that SAML signing keys were extracted. It also says access was likely still active when the report was published, and that 22 rooted firewalls were left “owned and parked” with webshells.

Two limits matter for readers:

• 25 servers is not 25 organisations or 25 victims. The count is a server inventory from one investigation.
• The 25-server count remains Dream’s. Unit 42 says it verified the attacker’s tooling and the reported results, but it does not itemize the 25 servers or name victims. No government agency has published a matching victim list.

Dream Research did not attribute the activity to a named threat actor. It noted AI-related tooling among the recovered files, but said there was no direct evidence that AI wrote the exploit or ran the campaign.

Why it matters

The KEV listing already established that PHP2Shell has been exploited. This report adds a detailed account of production systems being rooted through the PHP2Shell chain rather than only honeypots or laboratory tests, with Unit 42 saying it verified the attacker’s tooling.

It also reinforces the inventory problem. The targets were appliances running PHP, not a CMS or an application plugin. A firewall, VPN gateway or management appliance can ship a PHP runtime that the site owner never sees in a package manager. Patching the application layer would not have addressed these hosts.

The fixed releases and the operational advice do not change. The difference is the evidence level: KEV is a government determination of exploitation; the 25-server campaign is a vendor’s account now supported by Unit 42’s tooling verification, but still without a published victim list.

What to do now

• Patch PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, then restart every PHP worker.
• Inventory PHP inside appliances, firewalls, VPN gateways and management interfaces, not only application servers.
• If an appliance cannot be patched, isolate it and ask the vendor for the PHP version, the fixed release or backport, and restart evidence.
• Treat a rooted appliance as a network compromise, not a single-host incident: review LDAP, Active Directory, certificate stores and tunnel activity.
• Preserve logs before rebuilding, and check for webshells, new services and rc.local changes.

The verification guide covers runtime checks. The mitigation guide covers the sequence when patching cannot happen immediately. The dossier keeps the CVE scope and source links together.