Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers
Summary
Dream researchers detail a sophisticated chained exploit (PHP2Shell plus Fragnesia) that rooted 25 firewalls across multiple countries, including a US government-affiliated environment. The report highlights AI-assisted tooling in the attack, a global discovery process, and a multi-stage exploitation chain that culminated in an Active Directory compromise via a tunnel and pivot through the firewall management server.