Asl matn EN tilida, manba saytidan olindi. Manba ↗

Vulnerabilities

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization.

By

Ionut Arghire

| October 28, 2026 (8:00 AM ET)

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

A China-linked threat actor has been exploiting thePHP2Shellvulnerabilities to gain root access to firewalls and deploy webshells for persistent access, cybersecurity firm Dream reports.

The hackers have been chaining an exploit for the two PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619, with another for Fragnesia, a privilege escalation bug in the Linux kernel tracked as CVE-2026-46300.

As part of the observed attacks, the hackers used the Chinese internet asset search engine FOFA to identify 19,000 internet-facing firewalls from a specific vendor, and proceeded to exploit 25 of them on October 23-24, Dream says.

After discovery, the hackers first filtered servers in the US, Japan, Taiwan, and South Korea, then filtered those running newer PHP releases, which gave them a pool of 240 potential targets.

Using an automated tool, the attackers then targeted the firewalls with the full PHP2Shell-Fragnesia exploit chain, dropping a PHP root webshell on 24 devices for persistent access.

While no post-exploitation activity was observed on 22 of the firewalls, the hackers did progress further on two servers belonging to a US government-affiliated environment.

Advertisement. Scroll to continue reading.

The first rooted server crashed shortly after exploitation, on October 23. The attacker launched a second wave of attacks on October 24, which was successful.

“The attacker monitored [the first firewall] with 240 automated probes over two hours, waiting for it to recover. It didn’t. The second firewall, whose certificate data definitively linked it to the target organization, had timed out during the original batch,” Dream notes.

To maintain access to the firewall, the attackers deployed a reverse SSH tunnel and then used it to target an internal firewall management server with the PHP2Shell-Fragnesia chain, gaining access to the configurations, credentials and settings of every firewall the organization managed.

The hackers then used the management server to access and decrypt the LDAP service account password, enumerate users and groups in the domain, perform password spraying attacks, and attempt to create Active Directory backdoor accounts, among others.

Dream has not attributed the activity to a specific threat actor but believes it is part of a Chinese-nexus operation.

“Since US, Japan, Taiwan, and South Korea are the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater, this indicates potential nation-state adversary efforts,” Dream notes.

Related:Long-Hidden Flaws Patched in EPICS Research Facility Control Software

Related:Hackers Start Probing Fresh Oracle EBS Vulnerability

Related:CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts

Related:Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws

Written ByIonut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

More from Ionut Arghire

  • Unexplained DreamHost Incident Prompts Email, FTP Password Resets
  • Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
  • Genesys Hack Exposes Customer Data From Internal Systems
  • 953 Online Stores Infected in Long-Lasting Malware Campaign
  • Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
  • Mythos 5 Ignored Real-World Harm in July Attack
  • China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
  • Attackers Exploit Third Arista VCO Zero-Day in Four Months

Latest News

  • Long-Hidden Flaws Patched in EPICS Research Facility Control Software
  • Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
  • Secrets Management Firm Infisical Valued at $600 Million After $40 Million Raise
  • Hackers Start Probing Fresh Oracle EBS Vulnerability
  • CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
  • Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
  • Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk
  • HPE Patches Dozens of Critical Flaws in Networking Products

Trending

Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

PHP2Shell Exploitation Moves From Probes to Working Shells

iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18

Genesys Hack Exposes Customer Data From Internal Systems

Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws

Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts

Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics

953 Online Stores Infected in Long-Lasting Malware Campaign

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

Webinar: The AI Access Risk Already in Your Google Workspace

October 19, 2026

AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Noma Security has named Bobby Shoker as CFO and Alberto Rodrigues as CCO.

Neo has appointed Scott Stout as CRO.

CISA has sworn in Kan Wang as CFO and Khoi Nguyen as CAE.

More People On The Move

Expert Insights

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

Nobody Trusts the Security Questionnaire. We Rely on It Anyway.

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Context Is King in the Fight Against Modern Cyberattacks

Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)

AI Has Changed Attack Speed, Not Security Fundamentals

As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)