Dream Reports PHP2Shell Attack Chain That Compromised 25 Servers

Dream reported a PHP2Shell attack chain exploiting CVE-2026-109618 and CVE-2026-109619 combined with Linux privilege escalation CVE-2026-46300, compromising 25 servers including U.S. government-affiliated systems. The attack accessed internal identity infrastructure but full Active Directory takeover remains unconfirmed. AI tools Claude Code, DeepSeek, and Kimi were found but no direct link to exploit creation or operator identity was established.