Dream Says a China-Linked Operator Chained PHP2Shell With the Fragnesia Kernel Flaw to Root 25 Firewall Servers, Then Tunneled From a US Government-Affiliated Firewall Into Active Directory

SINGAPORE - An operator that the cyber defense company Dream links to China wrote its own exploit for the PHP2Shell flaws, paired it with a Linux kernel privilege escalation called Fragnesia, and used the chain to take root on 25 servers in the United States, Japan, Taiwan, and South Korea, Dream said in research published Oct. 26. Two of the rooted firewalls, and the firewall management server behind them, sat in what Dream calls a US government-affiliated environment, and from there the attacker went after Active Directory.

Dream did not name the firewall maker. "For security purposes, we are not disclosing the vendor or the affected versions, and the vendor has been notified," its researchers wrote. What they did recover was the operation itself: the custom exploit, target lists, exploitation logs, and roughly 40 post-exploitation scripts, found through proactive threat hunting with the company's autonomous research product, Hero.

A custom exploit, calibrated version by version

PHP2Shell is the pair of PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. Dream says the build it recovered "is a custom, non-public build, not a copy of any known public exploit for PHP2Shell." It targets the session.upload_progress mechanism on the firewall's appweb management server, which runs PHP 8.0.30 with a high memory limit that makes the memory-corruption stages work.

The attack runs in four stages. First the operator floods the server with crafted multipart POST requests, about 383 MB worth, to force a predictable memory layout. A second request forces an out-of-bounds read whose leaked pointer, returned in a Set-Cookie header, gives the base address of libphp.so. A third round of memory pressure, about 500 MB, sets up a stale reference. The final request forges a PHP HashTable entry whose destructor callback points at PHP's system() function, so cleanup runs the attacker's command as the nobody user.

Code as nobody is not root, so the operator chained in Fragnesia, CVE-2026-46300, a flaw in the Linux kernel's XFRM ESP-in-TCP subsystem. Dream says it uses page-cache writes to overwrite /etc/pam.d/su, swapping its rules for pam_permit.so so that su root then succeeds with no password. Because that file is only 774 bytes, the exploit writes it one byte at a time. Both exploits run inside a single HTTP request, and Dream says the full chain, from unauthenticated connection to persistent root webshell, finishes in under 15 minutes.

The exploit is not fire-and-forget. It needs exact memory offsets that differ by firewall version, and Dream found 11 JSON version profiles, one per OS build the operator had tested, each carrying library SHA256 hashes, ELF build IDs, and heap-geometry parameters. One base profile on the newer release branch was fully lab-calibrated; the rest were provisional, calculated from the binary but not verified on a live instance.

From 19,000 discovered to 25 exploited

Dream describes a clear funnel. Using FOFA, a Chinese internet asset search engine, the operator found about 19,000 internet-facing firewalls from the targeted vendor worldwide. A custom scanner running 200 concurrent threads found roughly 5,000 alive and fingerprinted their versions. The operator then kept only devices in the United States, Japan, Taiwan, and South Korea that ran versions matching its exploit profiles, leaving a final list of 240.

An automated batch runner hit those 240 five at a time, with a 30-minute timeout each. For every success it ran the full chain, planted a 103-byte PHP root webshell, confirmed root by running id, and logged the host. Dream says 24 firewalls were rooted. For 22 of them, the operator did nothing more than drop the webshell, parking the devices for later.

The pivot into a government network

Two firewalls stood out because their configurations pointed to a US government-affiliated organization, with Common Access Card authentication and government-style asset naming. The running config handed the attacker the internal map: domain controllers, a central firewall management server, a Keycloak single sign-on server, a GitLab instance, VPN gateways, and the Active Directory domain.

The first of those firewalls was rooted on Oct. 23 at 18:14 UTC, then crashed, probably under the roughly 900 MB of exploit traffic, and never came back. Dream says the operator probed it 240 times over two hours waiting for it to recover. When it did not, the attacker built a dedicated campaign and rooted the second firewall on Oct. 24 at 10:09 UTC. Within hours it stood up an eight-port reverse SSH tunnel, wrapped in a systemd service and an rc.local hook so it survives reboots, forwarding access to the domain controllers, the management server, VPN infrastructure, and a SOCKS5 proxy.

At 11:35 UTC, less than 90 minutes after rooting the second firewall, the operator used the same PHP2Shell and Fragnesia chain against the internal firewall management server reached through the tunnel, bringing the total to 25 servers. Because that server already held LDAP connectivity to Active Directory, the attacker used it to launch the domain attack.

What defenders can confirm, and what they cannot

Dream says the operator decrypted the LDAP service account password from the device config, since root access gave it the master key, and enumerated every user and group over LDAP. It then sprayed organization-themed passwords against every account. The domain had lockoutThreshold=0, meaning no lockout, so the spray could run without limit. The operator also tried to create a backdoor user in every organizational unit and a machine account using the default MachineAccountQuota, analyzed ACL chains, and probed the Keycloak identity provider for SAML signing keys and authentication bypass.

Whether the spray found valid credentials, whether the backdoor accounts were created, or whether SAML keys were extracted, Dream cannot say. Those results stayed on the management server's local filesystem and were not among the recovered artifacts. From what Dream can confirm, the operator holds persistent, boot-surviving access to the internal network, root webshells on two firewalls and the management server, the full directory user and group list, decrypted LDAP credentials, and private keys pulled from the firewall filesystem. The 22 parked firewalls across the four countries remain live with active webshells.

A note of AI-assisted tooling

Dream does not attribute the campaign to a named group, but lists several indicators of a Chinese-nexus operation: the exclusive focus on four Pacific intelligence targets, the use of FOFA and a Chinese tunneling utility, infrastructure clocks set to China Standard Time, and Chinese-language prompts in the logs. It also found Claude Code installed and an offensive platform called aiscan configured with the Chinese models DeepSeek and Kimi. Dream was careful to limit that claim: "While we have no direct evidence that the AI tools were specifically used to write the exploit or the post-exploitation scripts, the code structure, commenting style, and consistency across ~40 scripts suggest AI-assisted development. That said, this operation does not appear to be a fully autonomous nation-state attack."

The practical lesson is older than any of the tooling. An exposed management interface, Dream notes, became the path into an identity infrastructure. The PHP flaws are fixed in PHP, but appliance vendors compile their own PHP into firmware, so defenders should keep PHP-backed management interfaces off the public internet, watch for the memory-exhaustion POST floods that the exploit's first stage requires, and treat a firewall that crashes under heavy management-port traffic as a possible exploitation attempt rather than a fault.