Days after PHP2Shell disclosure, active exploitation campaigns are already achieving real-world compromises. The vulnerability combines two PHP memory flaws that allow remote code execution without authentication in certain environments. Security researchers at Dream identified a coordinated attack that paired these PHP vulnerabilities with Fragnesia, a Linux privilege escalation flaw, to gain root access on 25 servers spanning the United States, Japan, Taiwan, and South Korea—primarily targeting firewall administration interfaces exposed to the internet.
The attackers located approximately 19,000 firewall instances, filtered them down to 240 potential targets, and successfully compromised 24 directly, with a 25th server breached through internal lateral movement. The attack sequence proved ruthlessly efficient: PHP2Shell granted initial access with limited permissions, the Linux flaw escalated privileges to root, and a webshell was installed for remote command execution in under 15 minutes. On 22 firewalls, attackers left persistence mechanisms in place for future access. In one environment connected to US government infrastructure, the attacker established a tunnel into the internal network, extracted credentials, and enumerated Active Directory users. On October 29, Palo Alto Networks confirmed active exploitation against PAN-OS and validated the tools and findings reported by Dream.
Organizations must treat this as urgent: apply available patches immediately, restrict firewall administration interfaces from internet exposure, and conduct thorough forensic investigation on any potentially compromised systems for persistent backdoors and stolen credentials.