China-Linked Hackers Exploit PHP2Shell and Fragnesia to Gain Root Access on Firewalls
A China-linked threat actor has chained vulnerabilities in PHP2Shell and the Linux kernel's Fragnesia to achieve root access on firewalls, compromising critical network infrastructure.
A sophisticated threat actor, believed to be operating with a Chinese nexus, has been actively exploiting a combination of vulnerabilities to gain deep access into network firewalls. The attackers are chaining two PHP flaws, identified as CVE-2026-109618 and CVE-2026-109619 (collectively referred to as PHP2Shell), with a privilege escalation bug in the Linux kernel known as Fragnesia (CVE-2026-46300).
The initial phase of the attack involves reconnaissance using the FOFA internet asset search engine to identify potential targets. Researchers observed the attackers filtering for approximately 19,000 internet-facing firewalls from a specific vendor. Further refinement narrowed down the pool to 240 potential targets by filtering for specific geographic locations (US, Japan, Taiwan, and South Korea) and newer PHP releases.
Using an automated tool, the threat actors then deployed the full PHP2Shell-Fragnesia exploit chain against these selected firewalls. This process successfully resulted in the deployment of a PHP root webshell on 24 devices, establishing a persistent backdoor for future access. The primary goal of this stage was to gain initial control and establish a foothold within the network perimeter.
While most compromised devices did not show further malicious activity, two servers belonging to a US government-affiliated organization became the focus of more advanced exploitation. One of these firewalls crashed shortly after the initial compromise. The attackers, demonstrating persistence, launched a second wave of attacks the following day, successfully compromising the second firewall, which was definitively linked to the target organization.
To maintain and expand their access, the attackers established a reverse SSH tunnel. This tunnel was then used to pivot to an internal firewall management server. By exploiting the same PHP2Shell-Fragnesia chain on this management server, the attackers gained access to sensitive configurations, credentials, and settings for all firewalls managed by the organization.
The ultimate objective of the attack was to compromise the organization's internal infrastructure. The threat actors leveraged their access to the management server to decrypt an LDAP service account password, enumerate domain users and groups, conduct password spraying attacks, and attempt to create Active Directory backdoor accounts. This indicates a clear intent to move laterally within the victim's network and potentially exfiltrate data or disrupt operations.
While the cybersecurity firm Dream, which reported on these attacks, has not definitively attributed the activity to a specific named threat actor, the targeting and methodologies strongly suggest a Chinese state-aligned operation. The focus on strategic adversaries and intelligence targets in the Pacific theater further supports this assessment, highlighting the ongoing sophisticated cyber espionage efforts by nation-state actors.