Dream Research says it recovered the full toolkit of a campaign that paired a custom, non-public PHP2Shell exploit (CVE-2026-109618 / CVE-2026-109619) with the Fragnesia Linux kernel privilege escalation (CVE-2026-46300) to get root on firewalls in a single unauthenticated HTTP request. Dream has not named the firewall vendor or affected versions and says the vendor has been notified. The firewall OS in question runs PHP 8.0.30 on its management web server.

• Funnel: about 19,000 exposed firewalls found through the Chinese search engine FOFA, about 5,000 fingerprinted, 240 left after filtering to the US, Japan, Taiwan and South Korea and to versions the exploit had offsets for, and 24 rooted on Oct 23 to 24, each with a 103-byte PHP root webshell.
• Pivot: 22 firewalls were left parked. On two that belonged to a US government-affiliated organization, the attacker built a boot-persistent reverse SSH tunnel and SOCKS proxy, then used the same chain on the internal firewall management server (the 25th server).
• Active Directory: from the management server the attacker decrypted the LDAP service-account password and enumerated all users and groups. Dream also saw password spraying (the domain had no lockout), attempts to create backdoor user and machine accounts, and attempts to pull SAML signing keys from Keycloak, but could not tell whether those succeeded.
• AI tooling: Claude Code and an offensive platform configured with DeepSeek and Kimi keys were on the attacker's infrastructure. Dream says the script style suggests AI-assisted development but it has no direct proof, and the operation was not fully autonomous.

Dream attributes it to a China-nexus operator based on language, timestamps and targeting. What to do: pull firewall and VPN management interfaces off the internet, apply each appliance vendor's PHP2Shell firmware fix as it lands, and patch Fragnesia on Linux hosts. If you have exposed management interfaces from a large firewall vendor, check them for the artifacts in the hunting item.