China-Linked Hackers Exploit PHP2Shell and Fragnesia to Root Firewalls
Cybersecurity researchers have uncovered a China-nexus operation where attackers chained critical PHP vulnerabilities and a Linux kernel bug to target multiple firewalls.
Radwan AbdulhadiEditor and technology writer
Attack Campaign Details and Exploitation Chain
A China-linked threat actor has been actively exploiting the PHP2Shell vulnerabilities to secure root access to firewalls and deploy webshells designed for persistent access, according to cybersecurity firm Dream. The malicious campaign involves chaining an exploit for two specific PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619, alongside another exploit targeting Fragnesia, a notable privilege escalation bug residing in the Linux kernel and tracked as CVE-2026-46300.
During the observed activity, the attackers utilized the Chinese internet asset search engine FOFA to map out 19,000 internet-facing firewalls supplied by a specific vendor. Out of this broader discovery pool, they proceeded to target and exploit 25 devices between October 23 and October 24, as detailed by Dream.
Target Filtering and Automated Deployment
Following their initial discovery phase, the hackers implemented specific filters focusing on servers located in the United States, Japan, Taiwan, and South Korea. They subsequently filtered out devices running newer PHP releases, narrowing down their scope to a targeted pool of 240 potential systems.
Employing an automated tool, the threat actors directed the full exploit chain against the selected firewalls. This automated deployment successfully dropped a PHP root webshell on 24 distinct devices to maintain long-term, persistent access.
Impact on US Government-Affiliated Environment
Although no subsequent post-exploitation activity was identified on 22 of the compromised firewalls, the attackers advanced their operations significantly further on two specific servers belonging to a US government-affiliated environment.
The first rooted server crashed shortly after the exploitation occurred on October 23. To address this, the attackers initiated a second wave of attacks on October 24, which ultimately proved successful.
As noted by Dream, the attacker monitored the initial firewall with 240 automated probes across a two-hour window, waiting for it to recover before moving forward. The second firewall, identified through certificate data linking it directly to the target organization, had previously timed out during the original batch.
Internal Network Pivoting and Lateral Movement
To preserve their foothold within the compromised firewall, the attackers established a reverse SSH tunnel. They then leveraged this tunnel to target an internal firewall management server utilizing the same exploit chain.
By infiltrating the internal management server, the threat actors obtained access to the configurations, credentials, and settings of every single firewall managed by the organization.
Domain Enumeration and Credential Operations
Following their lateral movement into the internal infrastructure, the hackers utilized the management server to access and decrypt the LDAP service account password.
Additional malicious actions included enumerating users and groups within the domain, executing password spraying attacks, and attempting to establish Active Directory backdoor accounts.
Attribution and Strategic Context
While Dream has not formally attributed the campaign to a named threat group, the cybersecurity firm assesses the activity as part of a broader Chinese-nexus operation.
According to Dream, because the United States, Japan, Taiwan, and South Korea represent the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations within the Pacific theater, this campaign strongly points toward potential nation-state adversary efforts.
Sources
- SecurityWeekChina-Linked Hackers Exploit PHP2Shell to Root Firewalls
Continue chronologically
Related stories
PHP2Shell Flaws Successfully Exploited in the Wild
Critical PHP2Shell remote code execution vulnerabilities are now successfully exploited in the wild following early disclosures and leaks.
Ex-Palantir Execs Launch Dream with $17M to Transform Construction
Former Palantir executives have launched Dream, securing $17 million in seed funding led by Andreessen Horowitz to build AI world models for construction.
CISA Confirms Active Exploitation of PHP2Shell Flaws
CISA adds critical PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog and orders federal agencies to patch systems quickly.
Mirai Botnet Operators Join PHP2Shell Attacks
Mirai botnet operators and attackers target PHP2Shell flaws as ASLR bypass exploits emerge, though no successful compromises are yet confirmed.
