Kiberxavfsizlik tadqiqotchilari sun'iy intellekt (SI) yordamida amalga oshirilgan, shubhali Xitoy bilan bog'liq tahdid aktori tomonidan PHP2Shell zaifliklaridan foydalanib ochiq tizimlarga kirgan hujum tafsilotlarini oshkor qildi.
2026-yil 25-oktabrda kuzatilgan faoliyat davomida hujumchi PHP2Shell ni yadro imtiyozlarini oshirish eksploit bilan birlashtirib, 25 ta serverni, jumladan AQSh hukumatiga aloqador muhitdagi uchta tizimni ildizdan buzdi.
"Ta'sirlangan qurilmalar yirik sotuvchining xavfsizlik devori dasturiy ta'minotining ma'lum versiyalarida ishlaydi," deb aytdi Dream kiberxavfsizlik firmasi. "Hujumchi keyin Active Directory ga qarshi hujumlar boshladi. Qayta tiklangan artefaktlar hisob ma'lumotlarini olish va katalogni tekshirishni tasdiqlaydi."
Ta'sirlangan sotuvchining nomi oshkor qilinmadi, ammo Isroil kompaniyasi ushbu tashkilotni xabardor qilganini aytdi. Hujum zanjiri asosan PHP va Linux yadrosiga ta'sir qiluvchi ikki to'plam zaiflikni birlashtiradi -
- PHP2Shell, CVE-2026-109618 va CVE-2026-109619 (CVSS ballari: 9.2) sifatida kuzatiladigan, autentifikatsiyasiz masofaviy kod bajarilishiga olib kelishi mumkin bo'lgan juft kamchiliklar
- Fragnesia, CVE-2026-46300 (CVSS balli: 7.8) sifatida kuzatiladigan Linux yadrosi mahalliy imtiyoz oshirish zaifligi
"Biz qayta tiklagan amalga oshirish maxsus, ommaviy bo'lmagan tuzilma bo'lib, PHP2Shell uchun ma'lum ommaviy eksploitning nusxasi emas," deb tushuntirdi Dream tadqiqotchilari. "U xuddi shu asosiy tushunchaga amal qiladi, ammo mustaqil ravishda ishlab chiqilgan va maqsadli xavfsizlik devori platformasi uchun maxsus moslashtirilgan ko'rinadi."
"Zaiflik xavfsizlik devorining appweb boshqaruv serveridagi PHP ning session.upload_progress mexanizmini nishonga oladi. Xavfsizlik devori operatsion tizimi PHP 8.0.30 dan yuqori xotira chegarasi bilan foydalanadi, bu esa hujumning xotira buzilish bosqichlarini amalga oshirishga imkon beradi."
PHP2Shell eksploit zanjirining maxsus qurollanishi, CVE-2026-46300 bilan birgalikda, AQSh, Yaponiya, Tayvan va Janubiy Koreya bo'ylab 25 ta serverni ildizdan buzgan deb aytiladi.
Dream tomonidan topilgan artefaktlar operatsiya laboratoriya muhitida eksploit ishlab chiqish bilan boshlanib, keyin AQSh hukumat tashkilotining ichki Active Directory domeniga doimiy kirish olish bilan davom etganini ko'rsatadi.
"Ildizdan buzilgandan so'ng, hujumchi AQSh hukumatiga aloqador muhitdagi uchta maxsus serverga e'tibor qaratdi," deb ta'kidladi kompaniya.
SI yordamida ishlatilgan vositalar bilan bog'liqlik hujum infratuzilmasida Anthropic ning Claude Code o'rnatilganligi, shuningdek, FOFA va aiscan deb nomlangan SI asosidagi hujum xavfsizlik platformasi uchun API kalitlari mavjudligi, bu platforma DeepSeek va Kimi dan katta til modellari (LLM) bilan sozlanganligi dalillaridan kelib chiqadi.
Bundan tashqari, kod tuzilishi, izoh uslubi va deyarli 40 ta skript bo'ylab izchillik rivojlanish jarayonini kuchaytirish uchun SI dan foydalanilganini ko'rsatadi. Dream ma'lumotiga ko'ra, butun operatsiya quyidagicha kechadi -
- Hujumchi FOFA dan foydalanib, butun dunyo bo'ylab ochiq boshqaruv interfeyslari bilan taxminan 19 000 ta internetga ulangan xavfsizlik devorini aniqlaydi.
- Maxsus versiya skaneri qaysi qurilmalar onlayn ekanligini va ular qaysi operatsion tizim versiyasida ishlayotganini aniqlash uchun ishga tushiriladi. Taxminan 5 000 ta qurilma versiya ma'lumotlari bilan javob beradi.
- Hujumchi serverlarni AQSh, Yaponiya, Tayvan va Janubiy Koreyada joylashganlarga filtrlaydi, so'ngra PHP 8.0.30 ishlaydigan yangi chiqarilish tarmoqlariga mos keladigan tizimlarga cheklaydi. Bu qadam 240 ta nishonni beradi.
- Nishon ro'yxati PHP2Shell-Fragnesia zanjirini eksploit qiladigan, xavfsizlik devoridagi ommaviy kirish mumkin bo'lgan katalogga PHP veb-shelni joylashtiradigan, ildiz kirishini tekshiradigan va nishonning xost nomi va IP manzilini CSV faylga yozadigan avtomatlashtirilgan partiya ishga tushirgichiga kiritiladi. Bu qadam hujumchiga 24 ta serverga ildiz kirishini olishga imkon beradi.
- Muvaffaqiyatli buzilgan tizimlardan ikkitasi AQSh hukumatiga aloqador tashkilotga tegishli deb aniqlanadi. Ulardan biri 2026-yil 23-oktabr, soat 18:14 UTC da ildizdan buzilgandan so'ng qisqa vaqt ichida ishdan chiqadi va hech qachon qayta onlayn bo'lmaydi. Hujumchi 2026-yil 24-oktabr, soat 10:09 UTC da ikkinchi tizimni muvaffaqiyatli ildizdan buzish uchun maxsus kampaniya o'tkazadi.
- Hujumchi ikkinchi tizimni buzib kirgan xavfsizlik devorini operator infratuzilmasiga qayta ulaydigan teskari SSH tunnel orqali ichki tarmoqqa doimiy kanal qurish uchun ishlatadi. Soat 11:35 UTC da uchinchi hukumat serveri xuddi shu usul bilan buziladi, yagona farq shundaki, bu faqat tunnel orqali erishish mumkin bo'lgan ichki xavfsizlik devori boshqaruv serveri edi. Ildizdan buzilgan serverlarning umumiy soni 25 ga yetadi.
- Hujumchi Active Directory ni nishonga olib, LDAP xizmat hisobining parolini shifrlash, foydalanuvchilarni ro'yxatga olish va har bir foydalanuvchi hisobiga tashkilot mavzusidagi parollar bilan parol purkash orqali hisob ma'lumotlarini olishga urinishni amalga oshiradi. Operatsiya shuningdek, orqa eshik Active Directory hisoblarini yaratishga ham urinish qiladi.
Faoliyat tahdid aktoriga haqiqiy hisob ma'lumotlarini muvaffaqiyatli topish yoki orqa eshik hisoblarini yaratishga imkon berganmi, bu aniq emas. Natijada, buzilishning to'liq ko'lami noaniq qolmoqda.
"AQSh, Yaponiya, Tayvan va Janubiy Koreya Tinch okeani teatrida Xitoy davlatiga mos keladigan kiber operatsiyalar uchun to'rtta asosiy strategik raqib va razvedka nishoni bo'lganligi sababli, bu potentsial milliy-davlat raqib sa'y-harakatlarini ko'rsatadi," deb aytdi Dream.
"Operatsiya ochiq boshqaruv interfeysi tashkilotning identifikatsiya infratuzilmasiga kirish yo'liga aylanishi mumkinligini ko'rsatadi. Ildizdan buzilgan boshqa 22 ta xavfsizlik devori faol veb-shel bilan saqlanib qolgan. AQSh hukumat tashkilotiga doimiy tunnel ehtimol hali ham ishlamoqda. Va hujumchi ular qo'shimcha operatsion tizim versiyalari uchun profillar ishlab chiqqan sari qayta tashrif buyurishi mumkin bo'lgan 19 000 ta barmoq izi olingan nishonga ega."
Oshkor qilish PHP2Shell zaifliklarining yovvoyi tabiatda faqat cheklangan eksploitatsiyasini ko'rganini, tahdid aktorlarining haqiqiy nishonlarga qarshi ishonchli hujum vektoriga aylantirishdagi qiyinchiliklarni, ularni o'z kampaniyalariga integratsiya qilganiga qaramay, ta'kidlaydi.
"Amalda bu eksploitatsiya qilinmaydigan axlat. Haqiqiy nishonlarni eksploitatsiya qilish uchun libphp.so dan ofsetlar kerak, ular har bir tuzilma uchun noyob va brut-forse qilish mumkin emas. Siz uni o'z sinov stendingizda takrorlashingiz mumkin, yoki agar siz allaqachon nishonning fayl tizimiga kirish huquqiga ega bo'lsangiz," deb aytdi Flare ma'lumotiga ko'ra, XSS forumida c0d3x taxallusi bilan tanilgan a'zo.
Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems.
The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root 25 servers, including three systems in a U.S. government-affiliated environment.
"The affected devices run specific versions of a large vendor's firewall software," cybersecurity firm Dream said. "The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration."
The name of the affected vendor was not disclosed, but the Israeli company said it notified the entity. The attack chain essentially brings together two sets of vulnerabilities impacting PHP and the Linux kernel -
- PHP2Shell, a pair of flaws tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2) that could result in unauthenticated remote code execution
- Fragnesia, a Linux kernel local privilege escalation vulnerability tracked as CVE-2026-46300 (CVSS score: 7.8)
"The implementation we recovered is a custom, non-public build, not a copy of any known public exploit for PHP2Shell," Dream researchers explained. "It follows the same underlying concept but appears to have been independently developed and tailored specifically for the targeted firewall platform."
"The vulnerability targets PHP's session.upload_progress mechanism on the firewall's appweb management server. The firewall OS uses PHP 8.0.30 with a high memory limit that enables the memory corruption stages of the attack."
The custom weaponization of the PHP2Shell exploit chain, coupled with CVE-2026-46300, is said to have rooted 25 servers across the U.S., Japan, Taiwan, and South Korea.
Artifacts discovered by Dream indicate that the operation started with exploit development in a lab environment before obtaining persistent access to a U.S. government organization's internal Active Directory domain.
"Once rooted, the attacker zeroed in on three specific servers in a U.S. government-affiliated environment," the company noted.
The links to AI-assisted tooling stem from evidence pointing to the installation of Anthropic's Claude Code in the attack infrastructure, along with the presence of API keys for FOFA and an AI-powered offensive security platform called aiscan configured with large language models (LLMs) from DeepSeek and Kimi.
What's more, the code structure, commenting style, and consistency across nearly 40 scripts suggest the use of AI to augment the development process. The entire operation, per Dream, unfolds as follows -
- Attacker uses FOFA to identify approximately 19,000 internet-facing firewalls with exposed management interfaces worldwide.
- A custom version scanner is executed to determine which among those devices are online and what operating system version they are running. About 5,000 devices respond with the version information.
- The attacker filters the servers to those located in the U.S., Japan, Taiwan, and South Korea, and then limits the scope to systems that match newer release branches running PHP 8.0.30. This step yields 240 targets.
- The target list is fed as input to an automated batch runner that exploits the PHP2Shell-Fragnesia chain, plants a PHP web shell on a publicly accessible directory on the firewall, verifies root access, and logs the target's hostname and IP to a CSV file. This step allows the attacker to gain root access to 24 servers.
- Two of the successfully compromised systems are identified as belonging to a U.S. government-affiliated organization. One of them crashes shortly after it was rooted on October 23, 2026, at 6:14 p.m. UTC and never comes back online. The attacker carries out a dedicated campaign to successfully root a second system on October 24, 2026, at 10:09 a.m. UTC.
- The attacker exploits the second system to build a persistent channel into the internal network via a reverse SSH tunnel connecting the compromised firewall back to the operator's infrastructure. At 11:35 a.m. UTC, a third government server is compromised using the same method, the only difference being that this was an internal firewall management server only reachable through the tunnel. The total number of rooted servers reaches 25.
- The attacker targets Active Directory to decrypt the LDAP service account password, enumerate users, and spray passwords against every user account using organization-themed passwords in an attempt to extract credentials. The operation also attempts to create backdoor Active Directory accounts.
It's unclear if the activity allowed the threat actor to successfully find valid credentials or create backdoor accounts. As a result, the full extent of the compromise remains indeterminate.
"Since [the] U.S., Japan, Taiwan, and South Korea are the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater, this indicates potential nation-state adversary efforts," Dream said.
"The operation illustrates how an exposed management interface can become a path into an organization's identity infrastructure. The 22 other rooted firewalls remain parked with active web shells. The persistent tunnel into the US government organization is likely still running. And the attacker still has 19,000 fingerprinted targets they can revisit as they develop profiles for additional OS versions."
The disclosure comes as the PHP2Shell vulnerabilities have witnessed only limited exploitation in the wild, with threat actors highlighting the challenges in converting a proof-of-concept (PoC) into a reliable attack vector against real targets despite integrating them into their campaigns.
"In practice it's unexploitable crap. To exploit real targets you need the offsets from libphp.so, which are unique to every build and impossible to brute-force. You can reproduce it on your own test bench, or if you already have access to the target's file system," a member who goes by the handle c0d3x on the XSS forum said, according to Flare.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.