Chinese APT Exploits VMware ESX Zero-Day, Chains PHP2Shell and Fragnesia for Firewall Root Access
APT group Warp Panda leveraged a VMware ESXi zero-day to cover tracks, while other China-nexus actors chained PHP2Shell and Fragnesia to gain root on firewalls.
A sophisticated cyber espionage campaign orchestrated by the China-nexus APT group Warp Panda has been uncovered, utilizing a zero-day vulnerability in Broadcom's VMware ESX hypervisor to obscure their malicious activities. The vulnerability, identified as CVE-2026-41709, was exploited by the group to significantly reduce the visibility of audit trails, allowing them to operate with greater stealth. This exploit was reportedly used in intrusions occurring in early 2026, well after the vulnerability was publicly disclosed and patched by Broadcom in July 2026.
Warp Panda has a history of targeting U.S. entities across various sectors, with a particular focus on the legal industry due to the sensitive nature of client communications and strategic materials it handles. The group's typical modus operandi involves exploiting internet-facing edge devices for initial access, then pivoting to VMware vCenter environments. Once inside, they deploy custom malware such as BRICKSTORM and SharpStorm to maintain persistent, covert access. Beyond infrastructure compromises, Warp Panda has also been observed breaching Microsoft 365 environments by obtaining user session tokens and, in some instances, registering new multi-factor authentication devices on compromised accounts.
The severity of CVE-2026-41709 was recognized by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which added it to its Known Exploited Vulnerabilities (KEV) catalog on October 28, 2026. Federal civilian agencies were mandated to address this vulnerability by November 11, 2026, highlighting its critical nature and active exploitation.
In parallel, a separate but related campaign saw China-nexus threat actors chaining together the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with a Linux kernel privilege escalation flaw known as "Fragnesia" (CVE-2026-46300). This exploit chain allowed attackers to achieve root access on compromised servers and firewalls. Researchers from Dream identified a complete attack operation that included custom weaponization of these vulnerabilities, targeting lists, exploitation logs, and approximately 40 custom post-exploitation scripts. This campaign resulted in the compromise of 25 servers across the United States, Japan, Taiwan, and South Korea, with a specific focus on three servers within a U.S. government-affiliated environment.
Fragnesia, a local privilege escalation vulnerability in the Linux kernel, was also added to CISA's KEV catalog on the same Wednesday, with a remediation deadline of October 31, 2026, and a forensic triage requirement. CISA noted that this vulnerability could be chained with the PHP2Shell flaws to implant webshells and execute commands as root. The attackers specifically targeted firewalls, planting webshells and extracting credentials from Active Directory domain controllers after gaining root access.
While Dream did not explicitly name the firewall vendor, Palo Alto Networks updated its advisory regarding PHP2Shell to indicate that active exploitation had been observed targeting its management interface exposed to the internet. Security researcher Kevin Beaumont also reported awareness of a ransomware group using PHP2Shell against Palo Alto Networks firewalls for initial access, and noted reports of Chinese state-sponsored groups using these vulnerabilities for espionage against the U.S. government.
Adding to the network security concerns, Cisco confirmed that a separate vulnerability (CVE-2026-76418) affecting its "classic" and next-gen firewalls has been actively exploited to cause denial-of-service conditions. The vulnerability arises from logic errors when secondary authentication is configured on a tunnel group, allowing unauthenticated remote attackers to crash devices by sending a crafted request when connecting to the SSL remote access VPN. Cisco has strongly recommended customers upgrade to a fixed software release, as no workarounds are available. This Cisco firewall vulnerability had not yet been added to CISA's KEV catalog at the time of reporting.
These intertwined incidents highlight a concerning trend of sophisticated threat actors leveraging zero-day exploits and chained vulnerabilities to achieve deep system access and conduct espionage or disruptive attacks, particularly targeting critical network infrastructure like firewalls and hypervisors. The involvement of China-nexus groups underscores the ongoing geopolitical cyber tensions and the persistent threat to national security and critical infrastructure.