GoKawiilDream Security finds Chinese exploit chain rooted 25 firewalls, 3 US government servers
Dream researchers say they uncovered artifacts from an AI-assisted campaign that combined a custom PHP2Shell exploit chain with a kernel privilege-escalation flaw to compromise firewall devices. The campaign reportedly rooted 25 servers across the US, Japan, Taiwan and South Korea, with three machines in a US government-affiliated network singled out for further attacks on Active Directory, including credential theft and directory enumeration.
GoKawiil's interpretation of the reporting above, not reported fact.
The vendor and affected software versions remain undisclosed while patching is coordinated, meaning other exposed organizations may still be vulnerable without knowing it. Dream's researchers frame the incident as evidence that breaching a single exposed management interface can cascade into deeper identity-infrastructure compromise, which could complicate incident response for government defenders beyond simply patching the initial flaw.
- A chained exploit using PHP2Shell and a kernel LPE flaw reportedly compromised 25 servers across four countries.
- Three servers in a US government-affiliated environment were targeted for deeper access into Active Directory.
- The vendor and vulnerable firewall versions are being withheld publicly while the vendor works on a fix.
YubiKey 5C NFC Security Key — With attackers chaining exploits to steal credentials and pivot into Active Directory, hardware-backed authentication is one of the best defenses against credential theft. A YubiKey adds a physical layer of security that phishing and stolen-password attacks can't bypass, making it a smart addition to any security-conscious admin's toolkit.”,
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: dreamgroup.com, 2026-10-29
Published there as: “Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.