How it worked. The attacker used FOFA, a Chinese search engine for internet-connected devices, to list about 19,000 exposed firewalls from one vendor, narrowed that to 240 in the four countries running newer PHP, then fired an automated tool at them. The chain gets root with one HTTP request and no password: PHP2Shell abuses PHP's upload-progress feature on the firewall's web management page (the box runs PHP 8.0.30) to run code, and Fragnesia lifts that to full control. Dream counts 24 perimeter firewalls with a root webshell (a hidden backdoor page) plus one internal management server.
Where it got serious. On 22 firewalls Dream saw no follow-up. On two in a US government-affiliated environment, the attacker set up a reverse SSH tunnel (a hidden connection back out), hit the organization's internal firewall management server with the same chain, and got the settings and credentials for every firewall it managed. From there it decrypted an LDAP service account password, listed users and groups, ran password spraying and tried to create Active Directory backdoor accounts. Whether it got working credentials or a backdoor: Undisclosed, Dream says the full extent is not known. Threat actor: not named; Dream calls it a likely China-nexus operation.
The AI angle, read carefully. Claude Code was installed on the attacker's server, alongside an offensive tool called aiscan wired to Chinese models DeepSeek and Kimi. Dream says it has no direct proof AI wrote the exploit, only that the style of about 40 scripts suggests AI help, and that this was not a fully autonomous attack.
What I'd do today. PHP2Shell has been public since Oct 21, and CISA already flagged in-the-wild use on Oct 27. Take firewall and VPN management pages off the internet, or lock them to an admin network. Ask every firewall vendor you run, in writing, whether their appliance OS ships an affected PHP build and when a fixed image lands. Then treat the management server as a crown jewel: rotate any LDAP or service account stored in firewall configs and watch Active Directory for new accounts and spraying from firewall or management IPs.