Custom Exploit Chain Roots Firewall Servers via PHP2Shell and Fragnesia
Researchers discovered a 15-minute exploit chain targeting PHP 8.0.30 and 7.4.33 that grants unauthenticated root access to exposed firewall management…
Security firm Dream identified a custom exploit chain that rooted 25 firewall servers across the US, Japan, Taiwan, and South Korea, including three systems in a US government-affiliated environment. Researchers discovered artifacts on October 25. The attack combines a custom build of the PHP2Shell remote code execution exploit (CVE-2026-109618 and CVE-2026-109619) with the Fragnesia Linux kernel privilege escalation (CVE-2026-46300), granting root access via a single unauthenticated HTTPS request to an exposed management interface. Dream has notified the unnamed vendor, whose affected versions remain undisclosed.
The PHP2Shell stage targets PHP 8.0.30 via session.upload_progress on the appweb management server using memory exhaustion, an information leak of libphp.so's base address, a stale-reference setup, and a forged HashTable entry to call system() as the unprivileged nobody user. To bypass SELinux, the attacker used Fragnesia in the kernel's XFRM ESP-in-TCP subsystem to overwrite /etc/pam.d/su so su root requires no password. The full chain takes under 15 minutes.
Attackers used 11 JSON profiles for version-specific memory offsets (nine for PHP 8.0.30 and two for PHP 7.4.33). Using FOFA and a custom scanner, they filtered down to 240 targets and rooted 24 firewalls, planting a 103-byte PHP webshell on each. Two rooted firewalls belonged to a US government organization. The first was rooted on October 23 at 18:14 UTC and crashed from exploit traffic, while the second was exploited on October 24 at 10:09 UTC.