PHP2Shell Exploitation Reports: Firewalls Breached, Webshells Planted

PHP2Shell exploitation reports are now public. GreyNoise has counted at least six successful attacks on CVE-2026-109618 and CVE-2026-109619, and the security firm Dream says a Chinese threat actor used the bugs to compromise 24 firewalls. If you run PHP anywhere, including inside a security appliance, a patch closes the hole but removes nothing already planted.

What has actually been confirmed about PHP2Shell?

The bugs are on the U.S. government’s list of exploited vulnerabilities, and GreyNoise has observed them being exploited in the wild. According to The Record, CVE-2026-109618 and CVE-2026-109619, the pair nicknamed PHP2Shell, were added this week to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Federal agencies were given until Thursday to patch.

GreyNoise counted at least six successful exploitations, reported as one combined figure for both CVEs. The deadline binds federal agencies, but the scanners hunting for PHP2Shell do not check who owns a target. Everything else in this story comes from a single vendor report that no government agency has confirmed.

How did attackers use PHP2Shell against firewalls?

According to Dream, the attacker chained PHP2Shell with a Linux flaw to take root on firewalls from a large vendor that Dream has not named.

Kfir Fleischer, Dream’s vice president of cyber research, said PHP2Shell gave command execution on the appliance but not full control. So the attacker added CVE-2026-46300, a Linux privilege-escalation flaw that joined the same catalog on Wednesday.

That two-step pattern is common on appliances. A webshell runs with the rights of the web process that hosts it, usually a low-privilege service account. Rewriting firewall rules, reading key material or installing persistence requires root, and getting root requires a second bug.

How 19,000 devices became 24

Of 240 targeted firewalls, 24 were compromised, roughly one in ten. The attacker started with FOFA, a Chinese internet-asset search engine similar to Shodan, and found about 19,000 internet-facing firewalls. That list was cut to about 5,000, filtered to the United States, Japan, Taiwan and South Korea, then narrowed by exploit profile to 240.

A search hit shows that a device exposes a matching banner or service. It does not prove the device is vulnerable. Websites get found through the same discovery step, as we explain in how attackers find exposed websites.

• Most attacks took place between October 23 and 24.
• The compromise let the attacker extract credentials and enumerate directories.
• On 22 of the 24 firewalls, the attacker did nothing beyond planting webshells that would allow later access.
• Two devices, both tied to one U.S. government-affiliated environment, received a custom follow-on attack.

One of those two crashed and never came back online. The other was targeted repeatedly. Dream says the attacker then zeroed in on three specific servers inside that environment, though it could not determine the full extent of the compromise.

What Dream says it recovered

Fleischer said the team recovered “a custom PHP2Shell implementation tailored to the targeted firewall platform, version-specific profiles, exploitation logs and post-exploitation scripts.” The logs show root verified by running the id command through the installed webshell. That proves root on the appliance, not a fallen internal network.

Dream says the chain was non-public and built for this platform. It assesses that the attacker likely still holds persistent remote access, a full Active Directory user and group listing, account credentials, private keys and network topology. A directory listing is reconnaissance, not domain admin. The credentials and keys are the bigger problem.

Dream bases its attribution on Chinese-language artifacts and Chinese tools and AI models (FOFA, DeepSeek and Kimi), plus evidence that Claude Code had been installed. That is a vendor assessment, not a government finding. Dream says it is working with the firewall vendor and authorities. CISA declined to comment and pointed to its earlier PHP2Shell advisories.

Why doesn't a WordPress or Joomla update fix PHP2Shell?

Because the flaw sits in the PHP interpreter, not in your CMS. Updating WordPress, Joomla, plugins or themes changes the code your site runs, not the engine that runs it. You need a PHP build that includes the fixes. PHP’s end-of-life branches stop receiving security patches, so an outdated branch means a migration.

Small operators face two blind spots. On shared hosting, the owner often cannot see which PHP build is live. PHP also runs in firewall consoles, router admin pages and VPN portals, which are fixed through vendor firmware, never by your host. Root on shared servers is just as serious; see what a root shell means on shared hosting.

Marcus Hutchins of Expel said the campaign appears to track a Chinese group known for attacking firewalls, routers and VPN appliances. He expected the kernel step, because it lets attackers “go from unprivileged shell access to full root and kernel permissions, which enables them to do just about anything the device is capable of doing.”

John Gallagher of Viakoo warned that the same scan-and-exploit method could reach internet-exposed operational technology and many other devices. End-of-life devices exposed to PHP2Shell, he said, need to be replaced and taken off the network quickly.

What should site owners check this week?

Start with the PHP version, because that closes the hole. Then hunt for anything an attacker left behind, because a patch removes nothing that already came through.

1. Get the exact PHP version. The reports cited here do not list affected or fixed builds, so ask your host: “Which PHP version and build is live on my account, and does it include the fixes for CVE-2026-109618 and CVE-2026-109619?” No clear answer means plan an upgrade or a move.
2. Confirm PHP was reloaded (the step most often missed). Long-running PHP-FPM workers can keep serving old code after the package updates. Ask the host to confirm a restart.
3. List every internet-facing admin interface: control panel, webmail, firewall management, VPN portal. Put anything that doesn’t need public exposure behind a VPN or IP allowlist.
4. Ask appliance vendors for version-specific guidance and an integrity check. Dream described exploits built for specific firmware versions, so a clean public scan tells you little.
5. Look for leftover access: unexpected admin users, new files in web roots, changed firewall rules, unfamiliar remote-access accounts and odd outbound connections.
6. Rotate credentials from a clean machine if exposure is confirmed: panel, FTP, database and mailbox passwords, private keys and API keys. Revoke active sessions.

From SiteGuarding’s own incident work: treat patching and eviction as separate jobs. A device can run updated code and still carry a shell planted before the update. Isolate it, preserve its logs before any reboot, and follow the vendor’s forensic process before deleting files. Dormant shells like the 22 in Dream’s report exist so attackers can come back.

On a web server, a server-side malware scan will catch a webshell dropped into a web root. On a closed appliance, you need the vendor’s own tooling.

What is still unknown about the PHP2Shell campaign?

• The firewall vendor and the affected firmware versions are not public.
• Nobody has said whether GreyNoise’s six exploitations overlap with Dream’s 24 firewalls, so do not add the numbers together.
• The owner of the government-affiliated environment, and whether the attacker still has access, remain unconfirmed.

FAQ

What is PHP2Shell?

The nickname for CVE-2026-109618 and CVE-2026-109619, two flaws in the PHP interpreter. Both are on CISA's Known Exploited Vulnerabilities catalog.

Has PHP2Shell been exploited in the wild?

Yes. GreyNoise reported at least six successful exploitations, and Dream says a Chinese actor compromised 24 firewalls, mostly between October 23 and 24.

What is CVE-2026-46300?

A Linux privilege-escalation flaw. Dream says attackers used it after PHP2Shell to turn limited command execution into root. It joined the same catalog this week.

Does updating WordPress or Joomla fix PHP2Shell?

No. The flaws are in the PHP runtime, so you need a patched, supported PHP build from your host.

Were U.S. government servers confirmed breached?

Not officially. Dream reports follow-on attacks on two firewalls in a U.S. government-affiliated environment, but CISA declined to comment.

Not sure what PHP your host runs, or whether something was left behind on your server? Our team can check and clean it. Get a security package for your site and we will start with a full scan.