Malik Haidar has spent over a decade at the intersection of threat intelligence and corporate defense, navigating the high-stakes world of multinational cybersecurity. With a career defined by deconstructing the strategies of state-sponsored actors, Haidar brings a unique perspective that blends technical forensic analysis with a high-level business understanding of risk. Today, he joins us to dissect the recent PHP2Shell and Fragnesia campaign, a sophisticated operation that has rattled security circles by turning theoretically “unexploitable” flaws into a functional, AI-powered weapon against critical infrastructure.
The discussion explores the mechanics of a complex attack chain that successfully rooted 25 servers, the role of large language models in modern exploit development, and the strategic implications for organizations in the Pacific theater.
PHP2Shell and Fragnesia vulnerabilities represent a significant shift in how memory corruption and privilege escalation are being weaponized today. In your view, what makes this specific exploit chain so much more dangerous than the typical vulnerabilities we see discussed in security forums?
The danger here lies in the synergy between the two flaws and the precision of the implementation. We are looking at CVE-2026-109618 and CVE-2026-109619, which carry a staggering CVSS score of 9.2, paired with Fragnesia, a Linux kernel local privilege escalation. While many in the community dismissed these as too difficult to exploit due to the need for specific memory offsets, this adversary didn’t just use a generic script; they developed a custom, non-public build tailored for a specific vendor’s firewall. The use of PHP 8.0.30 with a high memory limit on the appweb management server provided the perfect environment for the memory corruption to succeed. Seeing 25 servers rooted, including those in high-security environments, proves that what is “unexploitable” in a vacuum becomes a lethal reality when a nation-state actor spends the time in a lab to solve the engineering puzzle.
The integration of AI-assisted tools like Claude Code and DeepSeek-powered scanners seems to be a hallmark of this operation. How exactly does AI change the speed and scale of a campaign that starts with 19,000 potential targets?
AI acts as a force multiplier that removes the manual bottleneck of traditional reconnaissance and coding. In this campaign, the attacker used FOFA to identify roughly 19,000 internet-facing firewalls, which is a massive surface area to cover. By leveraging AI-powered offensive platforms like aiscan and LLMs from DeepSeek and Kimi, they were able to filter those down to 5,000 online devices and eventually a high-priority list of 240 targets matching the specific PHP 8.0.30 version. You can see the AI’s “fingerprints” in the consistency and commenting style across the 40 different scripts used to manage the operation. It allowed a single operator to act with the speed of an entire team, moving from initial discovery to rooting 24 servers in a single automated batch run.
We saw one government-affiliated server crash immediately after being rooted on October 23, 2026. What does this tell us about the risks of automated batch runners, and how did the attacker adapt to secure a persistent foothold on the second attempt?
The crash at 6:14 p.m. UTC is a classic example of the “noise” created by aggressive memory corruption exploits; even a perfectly crafted payload can destabilize a system if the timing is off by a fraction of a second. However, instead of retreating, the attacker showed remarkable persistence, returning on October 24 at 10:09 a.m. UTC to successfully root a second system. This time, they didn’t just plant a shell; they built a persistent reverse SSH tunnel back to their infrastructure. This tunnel was then used to pivot and compromise a third internal firewall that wasn’t even reachable from the public internet. It demonstrates a move from automated “smash and grab” tactics to a disciplined, manual deep-dive once they identified the high-value nature of the target.
Forum users have called these PHP flaws “unexploitable crap” because they require unique offsets from specific library builds that are nearly impossible to brute-force. How did this adversary manage to bypass such a high technical barrier to compromise servers across the Pacific theater?
The dismissal of these bugs by the wider community actually provided the attacker with a degree of “security through obscurity,” as many organizations likely deprioritized the patches. To overcome the offset challenge, the researchers at Dream found evidence that the attacker conducted extensive development in a lab environment to map out the target platform’s architecture. They weren’t guessing; they had likely obtained the specific firewall firmware and reverse-engineered it to find the exact memory addresses needed for the PHP session.upload_progress mechanism. This is a cold, calculated engineering effort that involved testing the exploit against specific release branches to ensure a high success rate. The result was a weaponized exploit that turned a “theoretical” bug into a functional key for 25 different front doors.
Once the attacker gained root access and targeted the Active Directory, they attempted to decrypt LDAP service account passwords and spray organization-themed passwords. How significant is the threat to the identity infrastructure of these organizations?
The pivot to Active Directory is the “endgame” for any serious intruder because it moves the compromise from a single device to the entire identity of the organization. By attempting to enumerate users and spray passwords, the attacker was looking for a way to blend in as a legitimate administrator, which is much harder to detect than a web shell. They even tried to create backdoor Active Directory accounts, which would provide a “forever” entrance even if the original firewall was patched and rebooted. While it is still indeterminate if they successfully extracted all the credentials they sought, the presence of a persistent tunnel into a U.S. government organization suggests they are playing a long game. The fact that 22 other firewalls remain “parked” with active shells means the attacker has a massive inventory of access points they can choose to activate at any moment.
What is your forecast for the evolution of AI-driven exploit development in the coming year?
I expect we will see a rapid “democratization” of high-tier exploitation techniques, where AI bridges the gap between identifying a vulnerability and creating a stable, reliable exploit. Historically, only the most elite groups could solve the memory offset problems we saw with PHP2Shell, but as LLMs become more adept at analyzing binary structures, that technical barrier will continue to crumble. We are entering an era where the time-to-exploit will drop from weeks to hours, and the volume of tailored, platform-specific malware will explode. For defenders, this means the old window of “patching within 30 days” is officially dead; if you aren’t automating your defenses with the same speed as the attackers, you are effectively leaving your doors wide open.
