NewsPublished 28 Oct 2026

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

Source SecurityWeek

Mentions 3 CVEs

Mentioned vulnerabilities

Description

A China-linked threat actor exploited chained vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) and a Linux kernel privilege escalation flaw (CVE-2026-46300, Fragnesia) to gain root access to firewalls of a US government-affiliated organization. The attackers used an internet asset search engine to identify vulnerable firewalls, successfully compromised 25 devices, and deployed persistent PHP root webshells on 24 of them. They further used a reverse SSH tunnel to access an internal firewall management server, extracting sensitive configurations and credentials, and attempted Active Directory backdoor creation. The attacks targeted firewalls in the US, Japan, Taiwan, and South Korea, indicating a strategic focus on these regions. The incident highlights a sophisticated multi-stage exploitation chain with significant impact on network security and domain control.

Impact

The exploitation allowed attackers to gain root access to multiple firewalls, deploy persistent webshells, and compromise an internal firewall management server. This led to exposure of firewall configurations, credentials, and settings, enabling further lateral movement within the network. The attackers decrypted LDAP service account passwords, enumerated domain users and groups, conducted password spraying attacks, and attempted to create backdoor accounts in Active Directory. This represents a severe compromise of network security and domain control for the targeted US government-affiliated organization.

Defensive guidance

Organizations should monitor for updates from the firewall vendor and apply any available patches for the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) and the Linux kernel privilege escalation (CVE-2026-46300). Additionally, review firewall configurations and credentials for signs of compromise, and investigate any unusual LDAP or Active Directory activity. Implement network segmentation and restrict access to firewall management interfaces to reduce exposure.

Summary

The threat actor chained exploits for two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with a Linux kernel privilege escalation vulnerability (CVE-2026-46300, Fragnesia) to root firewalls from a specific vendor. Using the FOFA search engine, they identified 19,000 internet-facing firewalls, filtered to 240 potential targets in strategic countries, and exploited 25 firewalls on October 23-24, 2026. Persistent PHP root webshells were deployed on 24 devices. On two firewalls belonging to a US government-affiliated organization, the attackers established reverse SSH tunnels to an internal firewall management server, gaining access to firewall configurations, credentials, and settings. They decrypted LDAP service account passwords, enumerated domain users and groups, performed password spraying, and attempted to create Active Directory backdoor accounts. The activity is attributed to a Chinese-nexus operation targeting strategic adversaries in the Pacific theater.

References

securityweek.com/china-linked-hackers-exploit-php2shell-to-root-firewalls/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 28 Oct 2026, 12:12 UTC

Technical details

References

Community reviews

Related threats