Cybersecurity researchers at Dream have uncovered a suspected Chinese-linked campaign that gained root access to 25 servers across the United States, Japan, Taiwan, and South Korea. The operation combined two vulnerabilities, PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and Fragnesia (CVE-2026-46300), to compromise exposed firewall management systems without authentication. The complete exploit chain reportedly took less than 15 minutes to establish a persistent webshell with root privileges.
The initial exploit targeted PHP's session.upload_progress mechanism on the firewall's appweb management server. The affected firewall operating system used PHP 8.0.30 with a high memory limit, which enabled the attacker to carry out memory corruption and achieve remote code execution. Researchers found that the exploit was a custom, non-public implementation designed for the targeted firewall platform rather than a copy of an existing public exploit. Its execution required precise memory offsets, which varied across operating system versions.
After gaining code execution, the attacker deployed Fragnesia (CVE-2026-46300), a kernel privilege-escalation exploit that used page-cache writes to modify /etc/pam.d/su. The exploit replaced the file's authentication rules with pam_permit.so, which allows authentication without checking credentials. Because the target file was only 774 bytes, the attacker used a byte-by-byte splicing technique to make precise modifications. This enabled the attacker to execute su root without supplying a password, escalating privileges to root.
Both exploits were integrated into a single HTTP request, allowing the attacker to move from an unauthenticated HTTPS connection to root-level access. Recovered artifacts included 11 JSON configuration profiles corresponding to different firewall operating system versions, exploitation logs, target lists, and approximately 40 custom post-exploitation scripts.
The attacker used FOFA, a Chinese internet asset search platform similar to Shodan, to identify approximately 19,000 internet-facing firewalls belonging to the targeted vendor. Using a custom scanner the attacker compiled a list of 240 potential targets in the United States, Japan, Taiwan, and South Korea.
Researchers said that 25 servers were compromised, with the attacker planting webshells on 22 of the breached servers.
In a separate campaign targeting two US government-affiliated servers, the threat actor established a persistent tunnel into the internal network, compromised the management server, extracted credentials, enumerated Active Directory, and launched attacks against the organization's directory infrastructure.
“The attack results — whether the password spray found valid credentials, whether the backdoor accounts were created, whether SAML keys were extracted — stayed on the management server's local filesystem and were not among the artifacts we recovered,” Dream researchers said. “What we cannot determine is whether the password spray, backdoor account creation, or SAML key extraction succeeded. If any of these attacks worked, the compromise extends far beyond the perimeter firewalls into the organization's identity infrastructure”
The investigation also uncovered possible signs of AI-assisted development and reconnaissance. Artifacts included Claude Code, the aiscan offensive security platform configured with the Chinese language models DeepSeek and Kimi, and API keys for FOFA.
“While we have no direct evidence that the AI tools were specifically used to write the exploit or the post-exploitation scripts, the code structure, commenting style, and consistency across ~40 scripts suggest AI-assisted development. That said, this operation does not appear to be a fully autonomous nation-state attack,” the researchers noted.
Researchers have not attributed the activity to any of known threat actors. However, the targeting of systems in four strategically significant countries, the custom exploit chain, and the persistent access established inside a US government-affiliated environment point to a Chinese state-backed operation. The researchers said they notified firewall vendor, but the report doesn’t provide the name of the manufacturer and affected software for security reasons.