PHP2Shell has victims now: 25 rooted firewalls, three of them inside a government-affiliated network, and a tunnel the researchers think is still open

We wrote twice this week that PHP2Shell was confirmed exploited and that nobody had named a victim. On 26 October the Israeli firm Dream published an account of 25 rooted servers, three of them inside an organisation it describes as United States government affiliated.

One thing first. The report is published by a company selling the product it says found this, it names neither the firewall vendor nor the victim, and nobody outside Dream has verified it. Everything below is that report's account.

The funnel

The operation ran from 8 October to the 24th. FOFA, a Chinese internet asset search engine, produced about 19,000 internet-facing firewalls. Around 5,000 answered with version information. Filtering to the United States, Japan, Taiwan and South Korea, and then to devices on PHP 8.0.30, left 240 targets.

A batch runner then went through those 240 in about two hours and rooted 24 of them, each receiving a small root webshell while the runner logged hostnames and addresses. The chain went from one unauthenticated HTTPS request to root, pairing the PHP2Shell pair with CVE-2026-46300, a Linux kernel privilege escalation flaw scored 7.8.

Of the 24, twenty-two were left, in the report's phrase, "owned and parked" with no persistence installed. Two were pursued, because they belonged to the same organisation.

What happened inside the government-affiliated network

The first of those was rooted on 23 October at 18:14 UTC. It crashed shortly afterwards and never came back, which is its own lesson about what an exploit does to a production firewall.

The second was rooted on the 24th at 10:09 UTC, tied to the same organisation through certificate data, and within hours it carried a reverse SSH tunnel that survives a reboot. Access through that tunnel was forwarded to domain controllers, the firewall management server, VPN infrastructure and a SOCKS5 proxy, which is most of a network in one hop.

At 11:35, less than 90 minutes after the firewall fell, the internal management server was compromised through that tunnel. That is the 25th server.

On the management server the attacker decrypted and extracted the LDAP service account password, enumerated every user and group, ran a password spray, attempted to create backdoor user and machine accounts, analysed Active Directory ACL chains, and probed a Keycloak server for authentication bypass and for its SAML signing key.

The spray detail is the one to sit with. The domain's lockout threshold was 0. No lockout, so guessing costs nothing.

The AI part is thinner than the headlines

Coverage of this has led with AI. The attacker infrastructure did hold AI tooling: Claude Code installed, an offensive platform called aiscan configured with DeepSeek and Kimi models, FOFA API keys, Chinese-language prompts in session logs and UTC+8 timestamps.

What the researchers actually write about it is narrower: "we have no direct evidence that the AI tools were specifically used to write the exploit or the post-exploitation scripts". The inference comes from code structure, commenting style and consistency across roughly 40 scripts. They also say the operation "does not appear to be a fully autonomous nation-state attack".

That is the second time this week a careful report has been louder in the retelling than in the original. Trend Micro said much the same thing about its Japanese cases: AI changed the pace and the paperwork, and the way in was old software and bad configuration.

The exploit was custom, and partly guesswork

Dream says the exploit is not a copy of any public proof of concept. The infrastructure held 11 version profiles covering tested firewall builds, of which 9 were exploitable. Only one was calibrated against a running virtual machine. The rest were provisional, calculated from binaries without live verification.

That is worth understanding, because the public argument about PHP2Shell has been that it is impractical against real targets since the memory offsets differ per build. This operation's answer was to compute offsets per build and accept that most were untested, then fire at 240 hosts and see which ones fell over.

What is still live, by the report's account

• The tunnel into the government-affiliated network is persistent, survives reboot, and is "likely still active".
• Root webshells sit on two firewalls and the management server, also likely still active.
• 22 further rooted firewalls across four countries are parked and ready.
• The attacker holds the full user and group listing, the decrypted LDAP service account credentials and the internal topology.
• Harvested from the firewalls: high-availability replication keys, SSL and TLS certificate keys, and device authentication keys.

What to do

• Patch PHP. The versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the federal deadline for the catalogue entries was 29 October.
• Check whether your edge devices embed a PHP build you do not control. That is what this operation targeted, rather than web servers people think of as PHP hosts.
• Set a lockout threshold. A domain that allows unlimited guesses turns any foothold into a credential problem.
• Hunt for reverse SSH tunnels and SOCKS proxies out of management networks, not just inbound connections.
• If an internet-facing firewall crashed unexplained between 23 and 24 October, treat that as an indicator rather than an outage.
• Rotate the keys a firewall holds. Replication keys and device certificates survive a reimage of everything else.

What is not established

• Which vendor's firewalls these were, and which versions. Dream withholds both and says the vendor was notified.
• Who the victim is, beyond government affiliated.
• Whether the password spray, the backdoor accounts or the SAML key extraction succeeded. The results stayed on a machine the researchers could not read.
• Whether AI wrote any of it. The researchers say they have no direct evidence, and the inference is stylistic.
• Who ran it. No named actor, and the indicators are the ones listed above rather than an attribution.
• Whether any of it is accurate. One vendor has published this, using its own product, and nobody has independently confirmed it.