Researchers at Dream disclosed an AI-assisted attack that combined the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) with a Linux kernel local privilege escalation vulnerability (CVE-2026-46300, CVSS 7.8) to root 25 servers across the U.S., Japan, Taiwan and South Korea. The chain targeted firewalls running PHP 8.0.30 on the vendor's appweb management server, using the session.upload_progress mechanism to achieve unauthenticated remote code execution and then escalating to root. The attacker scanned roughly 19,000 internet-facing firewalls, identified about 5,000 responsive devices, filtered to 240 that matched the vulnerable PHP version, and automated exploitation to plant web shells and log hostnames. Three of the compromised servers belonged to a U.S. government-affiliated network, with one crash and two persisting via reverse SSH tunnels. The operation also attempted LDAP password decryption, user enumeration and password spraying against Active Directory, though success remains unclear. 1