China-Linked Hackers Exploit PHP2Shell to Root Firewalls

Security firm Dream has disclosed that a suspected China-nexus threat actor is combining the PHP2Shell flaws, tracked as CVE-2026-109618 and CVE-2026-109619, with the Linux kernel privilege-escalation bug Fragnesia, tracked as CVE-2026-46300, to gain root control of internet-facing firewalls from a single vendor. Using the FOFA search engine, the attackers scanned roughly 19,000 exposed devices, narrowed the list to 240 likely-vulnerable targets running newer PHP versions, and planted root webshells on 24 of 25 attempted firewalls during an operation on October 23-24. On two devices tied to a US government-affiliated network, the intruders went further, pivoting through a reverse SSH tunnel into an internal firewall management server, from which they extracted configurations and credentials, decrypted an LDAP service account password, enumerated Active Directory users and groups, and attempted password-spraying and backdoor account creation. Dream has not named the specific group behind the campaign but notes the targeting pattern of US, Japan, Taiwan, and South Korea points to a likely nation-state operation.