A suspected China-nexus threat actor began attacking internet-facing firewall devices running vulnerable PHP software across four countries on 25 October 2026. The operation appears to have used exposed firewall management systems as the entry point to wider networks, with three of the compromised servers operating in a US government-affiliated environment.
The attacker targeted PHP’s session.upload_progress mechanism on the firewalls’ appweb management server. The affected devices run specific versions of a large vendor’s firewall software, using PHP 8.0.30 with a high memory limit.
A custom, non-public PHP2Shell implementation, combined with the kernel privilege escalation vulnerability CVE-2026-46300, gave the attacker root access to 25 servers. The servers were in the US, Japan, Taiwan and South Korea. The recovered implementation was distinct from known public PHP2Shell exploits.
Access to the three US government-affiliated servers provided entry to the organisation’s internal Active Directory domain. After gaining access, the attacker launched attacks against Active Directory. Dream cybersecurity firm recovered artifacts showing credential extraction and directory enumeration across the compromised networks.
Those artifacts also indicated that the exploit was developed in a lab environment before the attacker obtained persistent access to a US government organisation’s internal Active Directory domain. A persistent tunnel into that organisation is likely still running.
The attack infrastructure contained evidence of Anthropic’s Claude Code being installed. API keys for FOFA and aiscan were configured with large language models from DeepSeek and Kimi. Nearly 40 recovered scripts had a code structure, commenting style and consistency that suggested artificial intelligence had been used to augment development.
Twenty-two of the 25 rooted firewalls remain parked with active web shells, leaving the attacker with ongoing access to those systems. The actor also has 19,000 fingerprinted targets available to revisit.
Dream said the focus on the US, Japan, Taiwan and South Korea pointed to potential efforts by a nation-state adversary. The identity of the actor, any Chinese government body that may be directing it, the extent of data taken and the status of remediation across the compromised systems remain unknown.
Comments (0)