Dream reports a chain of PHP2Shell attacks that compromised 25 servers – Unite.AI

Dream reported a chain of PHP2Shell attacks that reportedly compromised 25 servers, including systems in an environment affiliated with the US government. The October 26 investigation describes an exposed firewall management interface that is becoming a path to internal identity infrastructure.

The reported total includes 24 perimeter firewalls and one internal management server. Dream withheld the affected vendor and software versions and said it had notified the vendor.

How the exploit chain crossed two security boundaries

The chain associated PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, with the Linux Fragnesia privilege escalation vulnerability, CVE-2026-46300.

These vulnerabilities face several obstacles. Remote code execution gives an attacker the ability to execute code via a reachable service. Local privilege escalation can then transform a limited foothold into control over the operating system. Their combination changes the problem of incident response: investigators must consider what the compromised appliance could access beyond its management interface.

Red Hat describes Fragnesia as a flaw in the Linux kernel’s XFRM ESP-in-TCP subsystem. Insecure cryptographic processing can allow a local attacker with limited privileges to alter the read-only file page cache, overwrite privileged binaries, and gain root privileges. This is therefore a distinct escalation mechanism, rather than the initial unauthenticated entry point.

Dream confirmed extracting an LDAP service account credential and enumerating the directory. It was unable to determine whether password spraying, attempting to create a backdoor account, or extracting the SAML signing key were successful. These limits matter: Confirmed access to directory information does not establish complete control of Active Directory.

What the AI ​​evidence establishes

Investigators found Claude Code installed and an offensive platform configured with DeepSeek and Kimi. Dream said it has no direct evidence that these tools wrote the exploit or post-exploitation scripts and does not characterize the operation as completely autonomous. The suggested Chinese connection is tentative; did not name any threat actors.

For defenders, this distinction separates observable tools from conclusions about authorship, operator identity, or autonomy. The presence of a coding assistant can support a hypothesis about the workflow, but it cannot by itself establish what decisions a model made or who directed the operation.

Fixes PHP and the previous exploitation window

The PHP Project’s October 21 advisory identifies PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as the security releases that address two critical remote code execution vulnerabilities. The first involves managing insufficient memory by leaving internal request data partially initialized; the other concerns the survival of the obsolete internal state after the backup memory has been freed.

The project warns that PHP installations serving web requests are at risk, with the highest risk assessed for Apache’s mod_php configuration. It says partial mitigations don’t provide complete protection and direct users to upgrade. For packaged equipment, the practical path to remediation depends on the vendor-supported firmware and backport-supported fixes, rather than the runtime version string alone.

Unite.AI has previously covered PHP patches and the role of frontier AI in flaw discovery. This new report shifts the focus from discovery to the consequences of an exposed distribution.

Separately, Amazon Threat Intelligence reported attempts to exploit PHP2Shell in its MadPot honeypot network starting on October 17, before public disclosure. This telemetry does not demonstrate that the same operator conducted the campaign described by Dream.

AWS recommends measuring mitigation timelines for critical Internet-connected vulnerabilities within hours, investigating from the first known exploit rather than the date of disclosure, and developing detections that do not rely solely on a specific CVE signature. For PHP2Shell it is recommended to look back at least to October 17th.

Where Dream technology fits in

On its company website, Dream positions Hero as a standalone cyber research system that supports vulnerability investigation, malware reverse engineering, forensic analysis and validated fixes. Its companion platform Sphere focuses on exposure mapping and defense prioritization in government and critical infrastructure environments.

The technical distinction is between investigating a particular weakness and understanding where it matters within an operational network. An edge appliance, its management server, and an identity directory can have different owners and patch cycles, but an attacker can link them into a single location. Effective containment requires examining that path along with installing the relevant updates.