Zaifliklar
Xitoy bilan bog'liq xakerlar PHP2Shell'dan foydalanib, fayrvollarni ildiz darajasida buzishdi
Hujumchilar PHP2Shell va Fragnesia zaifliklarini zanjir qilib, AQSh hukumatiga aloqador tashkilotning ikkita serverini buzishdi.
Muallif
Ionut Arghire
| 28-oktabr, 2026 (ET bo'yicha 8:00)
Xitoy bilan bog'liq tahdid aktori PHP2Shell zaifliklaridan foydalanib, fayrvollarga ildiz darajasida kirish huquqini qo'lga kiritib, doimiy kirish uchun vebshellar joylashtirmoqda, deb xabar beradi Dream kiberxavfsizlik firmasi.
Xakerlar CVE-2026-109618 va CVE-2026-109619 sifatida kuzatiladigan ikkita PHP zaifligi uchun eksploitni, Linux yadrosidagi imtiyozlarni oshirish xatosi bo'lgan Fragnesia zaifligi (CVE-2026-46300) bilan zanjir qilib ishlatishgan.
Kuzatilgan hujumlar doirasida xakerlar Xitoyning internet aktivlarini qidirish tizimi FOFA'dan foydalanib, ma'lum bir ishlab chiqaruvchining 19 000 ta internetga ochiq fayrvollarini aniqlashdi va 23-24 oktyabr kunlari ulardan 25 tasini ekspluatatsiya qilishdi, deydi Dream.
Aniqlangandan so'ng, xakerlar avval AQSh, Yaponiya, Tayvan va Janubiy Koreyadagi serverlarni filtrdan o'tkazishdi, so'ngra yangi PHP versiyalarini ishlatayotganlarni ajratib olishdi, bu esa ularga 240 ta potentsial nishon berdi.
Avtomatlashtirilgan vosita yordamida hujumchilar fayrvollarga to'liq PHP2Shell-Fragnesia eksploit zanjirini qo'llab, 24 ta qurilmaga doimiy kirish uchun PHP ildiz vebshellini joylashtirishdi.
22 ta fayrvolda ekspluatatsiyadan keyingi faoliyat kuzatilmagan bo'lsa-da, xakerlar AQSh hukumatiga aloqador muhitga tegishli ikkita serverda yanada chuqurroq harakat qilishdi.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
Birinchi ildizga olingan server ekspluatatsiyadan so'ng, 23 oktyabrda tezda ishdan chiqdi. Hujumchi 24 oktyabrda ikkinchi to'lqin hujumlarini boshladi va bu muvaffaqiyatli bo'ldi.
"Hujumchi [birinchi fayrvollni] ikki soat davomida 240 ta avtomatlashtirilgan tekshiruv bilan kuzatib, uning tiklanishini kutdi. U tiklanmadi. Ikkinchi fayrvoll, uning sertifikat ma'lumotlari nishon tashkilot bilan aniq bog'liqligini ko'rsatgan, asl partiyada vaqt tugashi tufayli o'tib ketgan edi," deb ta'kidlaydi Dream.
Fayrvollga kirishni saqlab qolish uchun hujumchilar teskari SSH tunnelini joylashtirishdi va keyin uni ichki fayrvoll boshqaruv serveriga PHP2Shell-Fragnesia zanjiri bilan hujum qilish uchun ishlatishdi, bu esa tashkilot boshqaradigan har bir fayrvollning konfiguratsiyalari, ma'lumotlari va sozlamalariga kirish huquqini berdi.
So'ngra xakerlar boshqaruv serveridan foydalanib, LDAP xizmat hisobining parolini ochish va shifrlash, domen ichidagi foydalanuvchilar va guruhlarni ro'yxatga olish, parol purkash hujumlarini amalga oshirish va Active Directory orqa eshik hisoblarini yaratishga urinishdi, shuningdek boshqa harakatlar ham amalga oshirildi.
Dream faoliyatni aniq tahdid aktoriga bog'lamagan, ammo bu Xitoy bilan bog'liq operatsiyaning bir qismi deb hisoblaydi.
"AQSh, Yaponiya, Tayvan va Janubiy Koreya Tinch okeani teatrida Xitoy davlatiga aloqador kiberoperatsiyalar uchun to'rtta asosiy strategik raqib va razvedka nishoni bo'lganligi sababli, bu potentsial milliy davlat dushman harakatlarini ko'rsatadi," deb ta'kidlaydi Dream.
Bog'liq: EPICS tadqiqot muassasasi boshqaruv dasturida uzoq yashiringan zaifliklar tuzatildi
Bog'liq: Xakerlar yangi Oracle EBS zaifligini tekshirishni boshlashdi
Bog'liq: CISA Node2Shell ekspluatatsiyasi haqida ogohlantirmoqda, honeypotlar hujum urinishlarini qayd etmoqda
Bog'liq: Tailscale "Tailworm" zaifliklarining muvofiqlashtirilmagan oshkor qilinishidan so'ng tezda tuzatishlarni e'lon qildi
Yozgan: Ionut Arghire
Ionut Arghire SecurityWeek uchun xalqaro muxbir.
Kundalik xabarnoma
So'nggi kiberxavfsizlik tahdidlari, tendentsiyalar va mutaxassis fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta xabarnomasiga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Maxfiylik siyosatimizni o'qing.
Ionut Arghiredan ko'proq
- Tushuntirilmagan DreamHost hodisasi elektron pochta, FTP parollarini qayta o'rnatishga undadi
- O'lik Popcorn Time yangilovchisi millionlab kompyuterlarni egallab olish xavfiga duchor qildi
- Genesys xakerligi ichki tizimlardan mijoz ma'lumotlarini fosh qildi
- 953 ta onlayn do'kon uzoq davom etgan zararli dastur kampaniyasida zararlangan
- Golland politsiyasi bank hisoblaridan 400 000 dollardan ortiq pulni o'g'irlagan NFC relay hujumlari bo'yicha ikkita shaxsni hibsga oldi
- Mythos 5 iyul hujumida haqiqiy dunyo zararini e'tiborsiz qoldirdi
- Xitoy APT ConnectWise hujumlarida AI pentest vositasi Artex'dan foydalanmoqda
- Hujumchilar to'rt oy ichida uchinchi Arista VCO nol kun zaifligini ekspluatatsiya qilishmoqda
So'nggi yangiliklar
- EPICS tadqiqot muassasasi boshqaruv dasturida uzoq yashiringan zaifliklar tuzatildi
- Hech kim xavfsizlik so'rovnomasiga ishonmaydi. Biz baribir unga tayanamiz.
- Maxfiy ma'lumotlarni boshqarish firmasi Infisical 40 million dollar yig'ib, 600 million dollarga baholandi
- Xakerlar yangi Oracle EBS zaifligini tekshirishni boshlashdi
- CISA Node2Shell ekspluatatsiyasi haqida ogohlantirmoqda, honeypotlar hujum urinishlarini qayd etmoqda
- Tailscale "Tailworm" zaifliklarining muvofiqlashtirilmagan oshkor qilinishidan so'ng tezda tuzatishlarni e'lon qildi
- Sotuvchi kalitining sizib chiqishi 238 000 Denver Health Plan a'zolarining ma'lumotlarini xavf ostiga qo'ydi
- HPE tarmoq mahsulotlarida o'nlab muhim zaifliklarni tuzatdi
Trendda
Node2Shell: Brotli zaifligi Microsoft, Node.js, Python paketlarida tuzatish to'lqinini keltirib chiqardi
PHP2Shell ekspluatatsiyasi tekshiruvlardan ishlaydigan shellarga o'tdi
iOS, macOS 27.2 286 ta xatoni tuzatdi; ekspluatatsiya qilingan zaiflik iOS 18 ga qayta o'rnatildi
Genesys xakerligi ichki tizimlardan mijoz ma'lumotlarini fosh qildi
Tailscale "Tailworm" zaifliklarining muvofiqlashtirilmagan oshkor qilinishidan so'ng tezda tuzatishlarni e'lon qildi
Golland politsiyasi bank hisoblaridan 400 000 dollardan ortiq pulni o'g'irlagan NFC relay hujumlari bo'yicha ikkita shaxsni hibsga oldi
Kiberxavfsizlik muammosi yirik Nyu-Meksiko shifoxonasini bemorlarni boshqa joyga yo'naltirishga va klinikalarni yopishga majbur qildi
953 ta onlayn do'kon uzoq davom etgan zararli dastur kampaniyasida zararlangan
Kundalik xabarnoma
So'nggi tahdidlar, tendentsiyalar va texnologiya haqida xabardor bo'lish, shuningdek soha mutaxassislarining chuqur fikrlarini olish uchun SecurityWeek elektron pochta xabarnomasiga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Maxfiylik siyosatimizni o'qing.
Vebinar: Google Workspace'dagi AI kirish xavfi allaqachon mavjud
19-oktabr, 2026
Google Workspace bilan bog'langan AI vositalari millionlab nozik elektron pochta va fayllarga kirishi mumkin. Tashkilotingiz xavfini aniqlash va AI kirishini boshqarish uchun ramkani o'rganish uchun ushbu sessiyaga qo'shiling.
Ro'yxatdan o'ting
Virtual tadbir: CISO Forum 2026 sammiti
10 va 11 noyabr, 2026
CISO'lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantirayotgan masalalarni ko'rib chiqish uchun birlashtiramiz.
Ro'yxatdan o'ting
Harakatdagi odamlar
Noma Security Bobby Shokerni moliyaviy direktor va Alberto Rodriguesni CCO etib tayinladi.
Neo Scott Stoutni CRO etib tayinladi.
CISA Kan Wangni moliyaviy direktor va Khoi Nguyenni CAE etib qasamyod qildi.
Harakatdagi ko'proq odamlar
Mutaxassis fikrlari
Hech kim xavfsizlik so'rovnomasiga ishonmaydi. Biz baribir unga tayanamiz.
Deyarli har bir B2B bitimini nazorat qiladigan jarayon yuboruvchining ishonchsizligi va qabul qiluvchining qabul qilishi asosidagi o'z-o'zini baholashdir. Nihoyat kompaniyalar o'rtasida ishonch uchun yaxshiroq asos mavjud. (Sravish Sridhar)
Bu normal: NetScaler nol kun zaifliklari bizga yangi normal haqida nima aytadi
Yaqinda Citrix NetScaler tuzatishlari e'lon qilinishi mumkinligi sababli, tuzatish boshqaruv quvurlarini tayyor saqlang. (Tod Beardsley)
AI dasturiy ta'minot xavfsizligining kaliti tezlik emas, balki yetuklikdir
Sizning dasturchilaringiz AI qabul qilish shkalasida qayerda joylashganligi xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta'sir ko'rsatadi. (Matias Madou)
Kontekst zamonaviy kiberhujumlarga qarshi kurashda qirol
Kontekstual himoya xavfsizlik jamoalariga signallarni bog'lash, keyin nima kelishini oldindan bilish va tahdidlar kuchayishidan oldin ularni to'xtatishga yordam beradi. (Etay Maor)
AI hujum tezligini o'zgartirdi, xavfsizlik asoslarini emas
AI zaifliklarni aniqlash va ekspluatatsiya qilishni tezlashtirgan sari, virtual tuzatish hali ham himoya chuqurligi va kuchli ilova xavfsizligi asoslariga bog'liq. (Joshua Goldfarb)
Vulnerabilities
China-Linked Hackers Exploit PHP2Shell to Root Firewalls
The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization.
By
Ionut Arghire
| October 28, 2026 (8:00 AM ET)
*
A China-linked threat actor has been exploiting thePHP2Shellvulnerabilities to gain root access to firewalls and deploy webshells for persistent access, cybersecurity firm Dream reports.
The hackers have been chaining an exploit for the two PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619, with another for Fragnesia, a privilege escalation bug in the Linux kernel tracked as CVE-2026-46300.
As part of the observed attacks, the hackers used the Chinese internet asset search engine FOFA to identify 19,000 internet-facing firewalls from a specific vendor, and proceeded to exploit 25 of them on October 23-24, Dream says.
After discovery, the hackers first filtered servers in the US, Japan, Taiwan, and South Korea, then filtered those running newer PHP releases, which gave them a pool of 240 potential targets.
Using an automated tool, the attackers then targeted the firewalls with the full PHP2Shell-Fragnesia exploit chain, dropping a PHP root webshell on 24 devices for persistent access.
While no post-exploitation activity was observed on 22 of the firewalls, the hackers did progress further on two servers belonging to a US government-affiliated environment.
Advertisement. Scroll to continue reading.
The first rooted server crashed shortly after exploitation, on October 23. The attacker launched a second wave of attacks on October 24, which was successful.
“The attacker monitored [the first firewall] with 240 automated probes over two hours, waiting for it to recover. It didn’t. The second firewall, whose certificate data definitively linked it to the target organization, had timed out during the original batch,” Dream notes.
To maintain access to the firewall, the attackers deployed a reverse SSH tunnel and then used it to target an internal firewall management server with the PHP2Shell-Fragnesia chain, gaining access to the configurations, credentials and settings of every firewall the organization managed.
The hackers then used the management server to access and decrypt the LDAP service account password, enumerate users and groups in the domain, perform password spraying attacks, and attempt to create Active Directory backdoor accounts, among others.
Dream has not attributed the activity to a specific threat actor but believes it is part of a Chinese-nexus operation.
“Since US, Japan, Taiwan, and South Korea are the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater, this indicates potential nation-state adversary efforts,” Dream notes.
Related:Long-Hidden Flaws Patched in EPICS Research Facility Control Software
Related:Hackers Start Probing Fresh Oracle EBS Vulnerability
Related:CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
Related:Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Written ByIonut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Ionut Arghire
- Unexplained DreamHost Incident Prompts Email, FTP Password Resets
- Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
- Genesys Hack Exposes Customer Data From Internal Systems
- 953 Online Stores Infected in Long-Lasting Malware Campaign
- Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
- Mythos 5 Ignored Real-World Harm in July Attack
- China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
- Attackers Exploit Third Arista VCO Zero-Day in Four Months
Latest News
- Long-Hidden Flaws Patched in EPICS Research Facility Control Software
- Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
- Secrets Management Firm Infisical Valued at $600 Million After $40 Million Raise
- Hackers Start Probing Fresh Oracle EBS Vulnerability
- CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
- Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
- Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk
- HPE Patches Dozens of Critical Flaws in Networking Products
Trending
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
PHP2Shell Exploitation Moves From Probes to Working Shells
iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
Genesys Hack Exposes Customer Data From Internal Systems
Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics
953 Online Stores Infected in Long-Lasting Malware Campaign
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Noma Security has named Bobby Shoker as CFO and Alberto Rodrigues as CCO.
Neo has appointed Scott Stout as CRO.
CISA has sworn in Kan Wang as CFO and Khoi Nguyen as CAE.
More People On The Move
Expert Insights
*
Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)
AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)
