Security · Updated 28 Oct, 09:32 pm IST

PHP2Shell chain roots 25 servers, hits U.S. government‑affiliated network

Why it matters for readers: It demonstrates how attackers chain multiple vulnerabilities and use custom exploits to breach networks.

On October 25, 2026 attackers combined PHP2Shell vulnerabilities with a Linux kernel local privilege escalation to root 25 servers.1
Three of the compromised systems belonged to a U.S. government‑affiliated environment, according to the reporting.1
The PHP2Shell flaws are tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) and the kernel bug is CVE-2026-46300 (Fragnesia, CVSS 7.8).1
Researchers from Israeli firm Dream said the exploit was a custom, non‑public build and that they notified the affected vendor and entity.1
Recovered artifacts indicate credential extraction and Active Directory enumeration followed the initial compromise.1

Get a brief like this every morning

Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.