PHP2Shell Attackers Chained a Linux Kernel Bug to Take Over Firewalls: What to Check on Your Firewall, VPN and Servers

The PHP2Shell flaws we've been tracking since Oct. 21 have now been used to take full control of firewalls. Security firm Dream says an attacker paired PHP2Shell with an older Linux kernel bug nicknamed "Fragnesia" and planted root-level webshells on firewalls in the U.S., Japan, Taiwan and South Korea. On Oct. 28, 2026, CISA added that kernel bug, CVE-2026-46300, to its Known Exploited Vulnerabilities list and noted it "can be chained with" the two PHP2Shell flaws "to implant PHP webshells and run commands as root." Federal agencies have until Oct. 31 to fix it. Today, Oct. 29, is their deadline for PHP2Shell itself.

This post adds the firewall and kernel side of the story to our earlier coverage: why updating WordPress won't fix PHP2Shell and what to check beyond your website.

What's been reported

Two bugs, one chain. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets an attacker run code on a server through PHP without logging in, but only with the limited rights of the web server. Fragnesia is a Linux kernel "privilege escalation" bug: code already running on a machine can use it to become root, the all-powerful administrator account. Dream says the attacker's final step fires both exploits in one web request, and the whole chain, from first contact to a root back door, takes under 15 minutes.
The targets were firewalls with exposed admin pages. According to Dream's Oct. 26 report, the attacker used a Chinese internet search service to find about 19,000 firewalls from one large vendor whose management interfaces were reachable from the internet. About 5,000 answered a version scan. The attacker narrowed those to 240 in four countries running versions it had built the exploit for, which use the older PHP 8.0.30. Dream says 24 firewalls were rooted, each with a tiny PHP webshell, a hidden back door for running commands. Dream hasn't named the vendor or the affected versions and says it notified the vendor.
One victim went much further. Two of the rooted firewalls belonged to a U.S. government-affiliated organization. Dream says the attacker built a reverse SSH tunnel into that network, used the same chain on an internal firewall management server (the 25th server), decrypted a stored directory service account password, listed every user and group in Active Directory, tried password spraying and tried to create backdoor accounts. Dream says it can't tell whether the spraying or backdoor attempts worked. For the other 22 firewalls, it says the attacker just left the webshell in place to come back later.
Who's behind it. Dream doesn't name a group but points to a China-nexus operation, citing the target countries, Chinese tools and AI models, and logs on China Standard Time. SecurityWeek and The Hacker News reported the same findings on Oct. 28.
The fixes exist. PHP's fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and CISA still says to take systems on PHP 8.1 or older offline until they're updated. Fragnesia isn't new: it was disclosed and patched in the Linux kernel in May, Tenable says, and Ubuntu lists fixed kernels for its supported releases. A kernel update only takes effect after a reboot.
How big is the exposure? Sysdig said on Oct. 28 that PHP2Shell exploitation "has since been confirmed," that researchers estimate 1.3 to 1.9 million potentially vulnerable internet-exposed hosts, and that downstream vendors affected include Cisco and Palo Alto Networks. That's a count of exposure, not of break-ins, and nothing public ties those two vendors to Dream's case.

Why it matters for a small business

Plenty of small offices assume PHP2Shell is a website problem. This case shows it isn't. Firewalls, VPN gateways, storage boxes, phone systems and cameras often run Linux and PHP under the hood to draw their admin pages, and you can't update that PHP yourself. Only the vendor's firmware update fixes it. If that admin page is open to the internet, it's the same kind of front door these attackers walked through.

The firewall is also the worst place to lose control. It holds VPN settings, saved passwords and often a service account that can read your Windows domain or Microsoft 365 directory. A dental or medical practice, a law or accounting firm, or a shop with a single firewall from its IT provider has every reason to ask today rather than wait for the vendor to announce something.

Clear takeaway

Make sure no firewall, VPN or other device admin page can be reached from the open internet, ask each vendor in writing whether its product uses an affected PHP version and when a fixed firmware ships, and make sure every Linux server you own or rent has a current kernel and has been rebooted.

What to do this week

Close the admin page to the internet. Ask your IT provider whether your firewall's or VPN's management page answers from outside your office. If it does, turn that off or limit it to your VPN or a short list of trusted addresses. Dream says the attack began with "a single unauthenticated HTTPS request to a management interface that should never have been exposed to the internet."
Ask the vendor about PHP2Shell. Get a written answer from your firewall or VPN vendor (or your IT provider) on whether the product is affected and whether a fixed firmware is out. Install it as soon as it is. Do the same for any storage box, phone system, camera recorder or building-system controller with a web login.
Patch and reboot Linux servers. For any Linux server or cloud machine you run, or a contractor runs for you, install the current kernel and reboot. Ask for the output of uname -r in writing and compare it with your distribution's fixed version.
Confirm your PHP version. For websites and web apps, get the exact PHP version from your host or developer: 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later, or a vendor package that says it includes the fix.
Look for the signs Dream describes. Ask whoever manages the device to check for unexpected small PHP files in web folders, an altered /etc/pam.d/su file, new startup services or outbound SSH connections nobody set up, and admin-page crashes or reboots after bursts of very large uploads.
Change the passwords the firewall knows. If a device may have been exposed, rotate its admin passwords, VPN passwords and any directory service account it uses to look up users, and check your domain for new accounts nobody created. Make sure accounts lock after repeated failed sign-ins: the domain Dream described had no lockout.
Keep evidence before you wipe. If anything looks wrong, take the device off the internet, save its logs and get help. A firewall back door can mean the rest of the network needs a closer look.

How Brotherly Technology can help

Brotherly Technology can check whether your firewall, VPN and other devices have admin pages open to the internet, chase the vendor answers and firmware updates, confirm your Linux servers and websites are patched, and look for the warning signs above. If you're not sure who manages your firewall, call us and we'll find out.