Cybersecurity researchers from Dream disclosed details on 28 October 2026 regarding an active cyberattack campaign that compromised twenty-five firewall servers across the United States, Japan, Taiwan, and South Korea. The incident occurred on 25 October 2026 and involved a coordinated effort by a threat actor to infiltrate critical perimeter infrastructure using custom exploits and kernel-level vulnerabilities.

The campaign relied on custom PHP2Shell exploits combined with a kernel privilege escalation vulnerability tracked as CVE-2026-46300. According to the disclosure, this combination allowed the threat actor to gain unauthorized root access to target systems and establish a persistent foothold within the compromised server environments.

The twenty-five rooted servers targeted specific firewall software versions distributed across multiple international regions. Among the compromised infrastructure, three servers belonged to a U.S. government-affiliated environment, which ultimately granted the malicious actors persistent access to an internal Active Directory domain.

Investigation into the attacker infrastructure revealed artifacts indicating the use of AI tools in the operation. Researchers found installations of Anthropic’s Claude Code, FOFA API keys, and an AI-powered offensive platform named aiscan that was configured with DeepSeek and Kimi language models.

While the full extent of the intelligence gathered or operational impact inside the targeted networks is still being evaluated, the successful breach of a government-affiliated Active Directory domain highlights significant risks for organizations utilizing vulnerable perimeter security appliances.

Security teams managing perimeter firewalls and similar network devices should review vulnerability disclosures and apply available patches or mitigations to prevent unauthorized root access and credential exposure across internal domains.

Stay alert, and keep your security measures updated!

Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news