Dream finds an AI-assisted PHP2Shell campaign that rooted 25 servers, including US government systems

Dream, an Israeli cybersecurity company, said on 26 October that on 25 October its researchers found the artifacts of a suspected Chinese campaign that chained a custom PHP2Shell exploit (CVE-2026-109618 and CVE-2026-109619) with the Fragnesia Linux kernel flaw (CVE-2026-46300) to root firewalls of one large vendor in a single request. The attacker found about 19,000 exposed firewalls through the Chinese search engine FOFA, filtered them to 240 in the United States, Japan, Taiwan and South Korea, and rooted 25 servers, then moved on three in a US government-affiliated environment and reached its Active Directory. Claude Code was installed on the attack infrastructure, and an offensive platform called aiscan was set up with DeepSeek and Kimi models. Dream found no direct evidence that AI wrote the exploit, but says the style of about 40 scripts suggests AI-assisted development. Dream has not named the vendor and says it notified it.

When

26 Oct 2026

ID

WTA-N-2026-0481

Where

International

Who

Dream, Anthropic, DeepSeek, Moonshot AI, PHP Foundation

Topics

Cybersecurity, AI incidents, AI agents

System

Claude Code and the aiscan platform with DeepSeek and Kimi models found on the attack infrastructure

Operator

suspected Chinese attacker

Type

firewalls rooted through PHP2Shell and the Fragnesia kernel flaw: 25 servers in the US, Japan, Taiwan and South Korea, Active Directory access at a US government-affiliated organisation

Status

disclosed 26 Oct 2026; vendor notified; disclosed by Dream · Incident ledger

Next stop on this Storyline: Elsewhere: ChinaVolta-Autodoxer infostealer uses AI models to profile and rank victims31 Oct 2026

Spotted an error? Email [email protected].