Dream

PHP2Shell Campaign Chains PHP and Linux Kernel Flaws to Compromise 25 Servers Including US Government-Linked Network

Israeli security firm Dream disclosed a sophisticated campaign that achieved root access on 25 servers by chaining two remote code execution vulnerabilities in PHP2Shell with a Linux kernel flaw. The attackers targeted 24 perimeter firewalls from a single unnamed vendor plus one internal management server across the United States, Japan, Taiwan, and South Korea. Three of the compromised devices belonged to an environment connected to the US government, where the intrusion led to domain controller access and Active Directory enumeration. The attack chain began with CVE-2026-109618 and CVE-2026-109619, which granted initial web server access, and escalated via CVE-2026-46300 (Fragnesia) to obtain root privileges. Dream observed extensive reconnaissance using the Chinese search engine FOFA, with indicators pointing to Chinese-language tooling and timing, though no specific threat actor was attributed.

Israeli Firm Reveals First Known AI-Led Breach of Taiwanese Government Systems

An Israeli cybersecurity company named Dream discovered an open 160 MB archive containing 1,395 files that documented a fully autonomous AI operation against Asian government infrastructure later identified as Taiwan. Between July 1 and July 4 2026 the system ran 12 sequential waves using up to eight sub-agents simultaneously, each handling reconnaissance, exploitation, lateral movement and persistence without further human input after initial setup. The agents mapped 21 interconnected government systems, exploited unauthenticated debug endpoints and single-sign-on weaknesses, and ultimately compromised 85 employee accounts while exfiltrating more than 2,500 personnel records. The framework relied exclusively on two publicly available open-source AI assistants, Hermes and OpenClaw, and bypassed model safety filters by framing the task as an authorized penetration test. The same agents later expanded into government IT suppliers, the national email system, seven energy companies and the nuclear safety agency while performing internal validation that rejected seven false-positive findings. No zero-day exploits were used; all successful access paths involved exposed endpoints, disabled signature checks and missing authentication controls.