PHP2Shell Flaws Now Being Exploited, With Firewalls Reportedly Compromised

Cybersecurity firm GreyNoise says it has seen at least six successful exploitations of two recently announced PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as "PHP2Shell". The flaws were added to a U.S. government catalog of exploited vulnerabilities this week, and federal agencies were given until Thursday to install patches.

Security company Dream has published a report describing what it believes is a campaign by a Chinese threat actor. It says the attacker used PHP2Shell to run commands on a firewall from a large, unnamed vendor, but that this alone was not enough for full control. The attacker then chained it with a second flaw, CVE-2026-46300, which affects Linux and was added to the same U.S. catalog on Wednesday. Dream says it found 24 compromised firewalls, which let the attacker extract credentials and list directories. Most of the attacks occurred between October 23 and 24. Dream did not specify how the affected servers are linked to the government.

Dream attributes the activity to a Chinese actor based on the use of Chinese language, known Chinese tools and Chinese AI models. It says it is working with the firewall vendor and relevant authorities. The U.S. Cybersecurity and Infrastructure Security Agency declined to comment on the report and pointed to its earlier PHP2Shell advisories.