Dream reports PHP2Shell chain with Fragnesia hit 25 servers

Dream said a PHP2Shell exploit chain combined with the Linux Fragnesia privilege-escalation flaw compromised 24 perimeter firewalls and one internal management server, including a system in a U.S. government-affiliated environment. The firm confirmed LDAP service-account credential theft and directory enumeration but withheld the vendor and software versions.

• 24 perimeter firewalls and 1 management server were compromised
• Fragnesia enables page-cache tampering and root via XFRM ESP-in-TCP
• LDAP service-account credential theft and directory enumeration confirmed
• PHP fixes released October 21: 8.5.12, 8.4.27, 8.3.36, 8.2.35