Warp Panda used VMware ESX zero-day; firewalls rooted and crashed
Original title: Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls
CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.
CrowdStrike says China-nexus group Warp Panda exploited Broadcom VMware ESX insufficient-logging flaw CVE-2026-41709 as a zero-day in early 2026 to reduce audit visibility, after gaining access via internet-facing edge devices and deploying BRICKSTORM and SharpStorm. Broadcom disclosed and fixed the flaw in July 2026; CISA added it to KEV on October 28 with a November 11 federal deadline. CISA also added Linux kernel bug CVE-2026-46300 (Fragnesia), due October 31, which can be chained with PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619. Dream says a China-nexus actor rooted 25 firewalls that way. Cisco confirmed active exploitation of CVE-2026-76418 to reload firewalls.
Unconfirmed: Dream did not name the firewall vendor; Kevin Beaumont’s ransomware and Chinese espionage claims about Palo Alto are his reports, and Help Net Security is awaiting Palo Alto comment.
- Warp Panda also stole Microsoft 365 session tokens and sometimes registered a new MFA device.
- Dream reported about 40 custom post-exploitation scripts and focus on three U.S. government-affiliated servers.
- Palo Alto said active exploitation targets its internet-exposed management interface.
- CVE-2026-76418 is a logic error when secondary authentication is set on a tunnel group.
- Cisco strongly recommends upgrading; the flaw is not yet on the KEV list.
Impact: Reduced audit logs, root on servers and firewalls, or firewall denial of service
| Product | Affected | Fixed in |
|---|---|---|
| Broadcom VMware ESX | — | fixed in July 2026 |
| Linux kernel | — | — |
| Cisco classic and next-gen firewalls | — | fixed software release |
| Palo Alto Networks firewalls | management interface exposed to the internet | — |
- 1.Federal civilian agencies must address CVE-2026-41709 by November 11 and CVE-2026-46300 by October 31.
- 2.Upgrade Cisco firewalls to a fixed release; Cisco says there is no workaround.
- 3.Follow Palo Alto Networks’ PHP2Shell advisory for internet-exposed management interfaces.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web ShellT1562.002 Disable Windows Event LoggingT1550.004 Web Session Cookie
- Threat actors
- Warp Panda
- Malware
- BRICKSTORMSharpStorm
- Organizations
- CrowdStrikeCISADream
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-41709 | Insufficient logging in VMware ESX for admin operations | 2.7 | <1% | KEV | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
| CVE-2026-76418 | Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth | 8.6 | <1% | KEV | KEV |
From the original article
3 min read at helpnetsecurity.com
China-nexus threat actors have exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the “Fragnesia” Linux kernel bug to root servers and firewalls, cybersecurity researchers claim. Cisco has also confirmed that attackers are crashing its firewalls with a newly disclosed vulnerability.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.