China-linked hackers root firewalls via PHP2Shell and Fragnesia
Original title: China-Linked Hackers Exploit PHP2Shell to Root Firewalls
Dream says attackers exploited 25 of 19,000 internet-facing firewalls on October 23-24 and planted root webshells on 24.
Dream reports a China-linked actor chained PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 with the Linux kernel privilege-escalation bug Fragnesia, CVE-2026-46300, to gain root on firewalls. Using FOFA, the attackers identified 19,000 internet-facing firewalls from one vendor, narrowed the pool to 240, and exploited 25 on October 23-24. On two servers tied to a US government-affiliated environment they opened a reverse SSH tunnel, compromised an internal firewall management server, decrypted an LDAP password, enumerated the domain, and tried password spraying and Active Directory backdoor accounts.
Unconfirmed: Dream calls it a Chinese-nexus operation but names no specific group, and the firewall vendor is unidentified.
- They first filtered out servers in the US, Japan, Taiwan, and South Korea, then newer PHP releases.
- A PHP root webshell was dropped on 24 devices; 22 showed no further activity.
- The first rooted government-linked server crashed; a second wave on October 24 succeeded.
- Attackers sent 240 automated probes over two hours waiting for the crashed firewall.
- The management server held configurations, credentials, and settings for every firewall the organization managed.
Impact: Root access, webshells, firewall configs, and domain credentials
| Product | Affected |
|---|---|
| PHP | — |
| Linux kernel | — |
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web ShellT1021.004 SSHT1110.003 Password Spraying
- Products
- PHPLinux kernel
- Organizations
- Dream
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
2 min read at securityweek.com
The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization. The post China-Linked Hackers Exploit PHP2Shell to Root Firewalls appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.