HOC Shorts | The Breaking Discovery:
Cybersecurity researchers uncovered a campaign in which attackers chained the PHP2Shell remote code execution flaw with a Linux kernel privilege escalation exploit (Fragnesia, `CVE-2026-46300`) to completely root 25 servers, including high-profile infrastructure linked to the US government.
- The Attack Chain: Attackers targeted exposed firewall management interfaces using a single, unauthenticated HTTP request combining PHP memory exhaustion (`session.upload_progress`) with a page-cache write to override PAM authentication rules.
- Global Footprint & AI Integration: The campaign scanned 19,000 global devices via FOFA, filtered 240 targets across the US, Japan, Taiwan, and South Korea, and successfully compromised 25 servers. Attackers utilized AI coding assistants like Claude Code and DeepSeek to structure their offensive scripts.
- Active Threat Status: Once inside the perimeter, attackers established persistent SSH tunnels, decrypted LDAP service credentials, and launched aggressive Active Directory enumeration.
Just when security teams thought the worst of the global PHP2Shell (`CVE-2026-109618` / `CVE-2026-109619`) vulnerability wave was beginning to stabilize, threat researchers uncovered evidence that the exploit engine has evolved into a fully automated, multi-stage weapon.
A cyber investigation into a recent campaign revealed that sophisticated threat actors successfully chained PHP2Shell with a Linux kernel privilege escalation vulnerability (Fragnesia, `CVE-2026-46300`) to completely compromise 25 servers across the globe—including sensitive systems within a US government-affiliated environment, according to dream report.
Fragnesia is a high-severity local privilege escalation (LPE) vulnerability in the Linux kernel, tracked as CVE-2026-46300. Disclosed on May 13, 2026,
Inside: How PHP2Shell and Kernel LPE Were Chained
Unlike standard spray-and-pray exploits, this campaign relied on a precision-crafted, non-public build designed specifically to defeat hardened enterprise firewalls running PHP 8.0.30.
1. Phase 1: Remote Code Execution (PHP2Shell): The attacker floods the target firewall’s appweb management server with massive multipart POST requests. By manipulating PHP’s `session.upload_progress` memory allocation, they force a memory corruption state, read out-of-bounds pointer values, and forge a PHP `HashTable` entry. This executes arbitrary commands as the unprivileged `nobody` user.
2. Phase 2: Privilege Escalation (Fragnesia LPE): Because standard SELinux security policies restrict the web daemon from modifying core system files, the attacker immediately fires a second exploit targeting the Linux kernel’s XFRM ESP-in-TCP subsystem. Using precise page-cache writes, they overwrite `/etc/pam.d/su` with `pam_permit.so`, allowing `su root` to succeed instantly without a password.
3. Phase 3: Network Pivot & Active Directory Enumeration: Once root access is secured, the attacker plants a persistent reverse SSH tunnel wrapped in a `systemd` service, connects to the internal management server, decrypts master LDAP credentials, and initiates unlimited password spraying against Active Directory.
The Funnel: From 19,000 Scanned to 25 Rooted
Telemetric analysis of the recovered campaign artifacts highlights a highly methodical, automated targeting funnel:
| Funnel Stage | Action Performed | Scale / Result |
| 1. Global Discovery | Queried the FOFA search engine for exposed firewall management certificates. | 19,000 targets identified globally. |
| 2. Version Fingerprinting | Executed 200-thread concurrent checks to verify live hosts. | 5,000 servers confirmed alive and online. |
| 3. Geographic & Version Filtering | Filtered for strategic targets in the US, Japan, Taiwan, and South Korea running PHP 8.0.30. | 240 target candidates selected. |
| 4. Automated Batch Exploitation | Deployed custom script runners testing 5 targets simultaneously with version-specific JSON memory profiles. | 24 perimeter firewalls rooted. |
| 5. Government Pivot | Identified high-value US government infrastructure, deployed tunnels, and rooted the central management server. | 25 total servers compromised. |
AI-Assisted Offensive Tooling
Forensic artifacts recovered from the operator’s staging environments revealed subtle but significant indicators of AI-assisted development. While the complex memory corruption mechanics and kernel offsets were hand-calibrated, investigators found installations of Claude Code, custom API keys for DeepSeek and Kimi, and roughly 40 auxiliary post-exploitation scripts exhibiting remarkably uniform coding styles and documentation.
Defensive Takeaways: Why Perimeter Defense Is Only Half the Battle
The rapid escalation of this campaign—moving from an unauthenticated perimeter exploit to internal Active Directory enumeration in less than 90 minutes—underscores a critical reality for enterprise security teams:
Vulnerability Patching Is Urgent, Not Optional: Perimeter devices running outdated PHP environments remain prime targets for automated exploit frameworks.
Assume Breach on Management Segments: Once a perimeter firewall falls, attackers immediately target internal management servers to extract master LDAP tokens.
Enforce Outbound Network Controls: Implementing strict egress filtering and blocking unauthorized reverse SSH tunnels can sever an attacker’s command-and-control bridge before lateral movement occurs.
