Suspected China-linked hackers have compromised a US government-affiliated network by exploiting newly disclosed PHP vulnerabilities, according to cybersecurity company Dream. The attack demonstrates how multiple security flaws can be combined to bypass network defenses and gain access to sensitive internal systems.
Researchers discovered the intrusion on October 25, 2026, shortly after two critical PHP vulnerabilities, collectively known as PHP2Shell, became public. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, each carry a severity score of 9.2 out of 10 and can potentially allow attackers to execute malicious code without authentication.
The attackers reportedly combined PHP2Shell with a Linux kernel privilege escalation vulnerability called Fragnesia, tracked as CVE-2026-046300. This two-stage approach enabled them to obtain root-level access to vulnerable firewall appliances.
Dream’s investigation revealed that the campaign began with extensive reconnaissance. The attackers scanned approximately 19,000 internet-facing firewalls across the United States, Japan, Taiwan, and South Korea, identifying around 240 vulnerable devices. Of those, 24 were reportedly compromised.
The operation subsequently reached an internal firewall management server belonging to an unidentified US government-affiliated organization. Researchers found evidence that the attackers obtained Active Directory credentials, potentially enabling further movement through the network.
Additional activity included enumerating user accounts, attempting passwords against multiple accounts, and trying to establish hidden access mechanisms. The attackers also sought cryptographic signing keys, although investigators could not confirm whether these later attempts succeeded.
Despite the successful intrusion, exploiting the vulnerabilities was technically challenging. Dream reported that even under favorable conditions, approximately 10% of exploitation attempts succeeded, partly because the PHP flaws required precise memory offsets specific to the targeted software versions.
Researchers also uncovered indications of artificial intelligence-assisted activity. The recovered environment contained installations of Claude Code and security tools configured to use Chinese AI models, including DeepSeek and Kimi. However, the findings do not establish exactly how extensively AI contributed to the attacks.
Dream suspects Chinese involvement based on language artifacts, operational timing, and the geographic distribution of targets. Nevertheless, the company has not identified a specific hacking group, and state sponsorship remains unconfirmed.
The incident comes amid widespread exploitation of PHP2Shell. Internet scanning company Censys identified approximately 32.5 million PHP services running potentially vulnerable versions, including 10.3 million in the United States.