1950s pulp-style illustration of a cream and red warning robot with beacon before a cracked firewall bulkhead in starry space, navy red and chrome on aged paper, no text

PHP2Shell + Fragnesia: Dream finds 25 rooted servers

Home » Alert » PHP2Shell + Fragnesia: Dream finds 25 rooted servers

ALERT · Actively exploited. Last updated 28 October 2026. See the Alert Tracker

Unpatched PHP on an internet-facing management interface, or a kernel still open to Fragnesia, is urgent. Patch, then hunt for shells from PHP workers and for changes to /etc/pam.d/su. Chain coverage here; the PHP bugs alone are in PHP2Shell: patch PHP now, then go hunting.

What it is

On 26 October 2026 Dream Research (opens in a new tab) published evidence of a campaign that chains PHP2Shell (CVE-2026-109618 (opens in a new tab) / CVE-2026-109619 (opens in a new tab)) with the Linux kernel local privilege escalation nicknamed Fragnesia (CVE-2026-46300 (opens in a new tab)). PHP2Shell yields unauthenticated remote code execution in the PHP worker. Fragnesia — a shared-fragment flaw in XFRM ESP-in-TCP — is then used to escalate. Dream reports the in-the-wild stage overwrites /etc/pam.d/su so authentication uses pam_permit.so, allowing passwordless su to root. Vendor and firewall OS versions are redacted; the vendor was notified.

Who is affected

Internet-facing hosts still on vulnerable PHP (fixed 21 October: 8.5.12, 8.4.27, 8.3.36, 8.2.35) and a kernel without the Fragnesia fixes. Dream’s recovered operation hit one large vendor’s firewall management interfaces in the United States, Japan, Taiwan and South Korea. Bundled or EOL PHP inside appliances (Dream notes PHP 8.0.30 on profiled builds) needs vendor firmware, not only a host PHP upgrade.

Exploitation status

Dream recovered a custom PHP2Shell + Fragnesia chain: about 19,000 FOFA hits narrowed to 240 targets, then 24 firewalls rooted (parked PHP root webshell) plus an internal management server — 25 servers across four countries, with further activity against a US government-affiliated environment. Dream does not name a specific actor; it assesses a Chinese-nexus operation from targeting and infrastructure indicators. Dream also reports evidence of AI-assisted tooling in the attack infrastructure (Claude Code installed; aiscan configured with Chinese LLMs DeepSeek and Kimi), while stating it has no direct evidence those tools wrote the exploit or post-exploitation scripts. CISA KEV (catalogue 2026.10.28) lists the PHP CVEs from 26 October (due 29 October) and Fragnesia from 28 October (due 31 October). FIRST EPSS on 28 October is near 0.99999 for the PHP CVEs and about 0.102 (~96th percentile) for Fragnesia.

Fix and mitigation

Upgrade PHP to the fixed builds and restart the web stack. Apply Fragnesia kernel updates from your distribution (Ubuntu CVE-2026-46300 (opens in a new tab)). For appliances, follow the vendor’s advisory. Until patched, keep management interfaces off the public internet. Federal civilian agencies: meet the KEV due dates and BOD 26-04 guidance in the KEV notes.

How to hunt

Behavioural starting points only. Dream did not publish a webshell path or filename — do not invent indicators. Hunt Lab pack 2026-10-28-php2shell-fragnesia-chain (opens in a new tab) (the ES|QL variant is being corrected) ships Sigma, KQL and Splunk for PHP/web parents spawning shells, and for create/change events on /etc/pam.d/su. Companion to the 2026-10-22 PHP spawn hunt (opens in a new tab).

// Defender XDR — PHP/web parent spawning a shell (tune before use)
DeviceProcessEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName matches regex @"^php(-fpm|-cgi)?[0-9.]*$"
    or InitiatingProcessFileName in~ ("httpd","apache2","nginx","frankenphp","lsphp","appweb")
| where FileName in~ ("sh","bash","dash","curl","wget","nc","ncat","perl","python","python3","base64","su")
| summarize Events=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessFileName, FileName

// Defender XDR — PAM su / pam.d writes
DeviceFileEvents
| where Timestamp > ago(30d)
| where ActionType in ("FileCreated","FileModified","FileRenamed")
| where FolderPath has "/etc/pam.d" or FilePath has "/etc/pam.d/"
| project Timestamp, DeviceName, ActionType, FilePath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

On a suspect host, check /etc/pam.d/su for an unexpected pam_permit.so line, review recent web-root PHP drops, and rotate credentials from any compromised management plane.

Sources

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)