Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls

CrowdStrike reports that the China-linked group Warp Panda exploited an insufficient-logging flaw in Broadcom's VMware ESX hypervisor, tracked as CVE-2026-41709, as a zero-day to erase evidence of intrusions while deploying malware like BRICKSTORM and SharpStorm against legal-sector targets. The bug was patched in July 2026, and CISA has now added it to its Known Exploited Vulnerabilities catalog, giving federal agencies until November 11 to remediate. Separately, researchers at Dream uncovered an AI-assisted campaign in which a Chinese state-linked actor combined the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) with the Linux kernel privilege-escalation bug known as Fragnesia (CVE-2026-46300) to gain root access on 25 firewalls across the US, Japan, Taiwan, and South Korea, plant webshells, and steal Active Directory credentials, with Palo Alto Networks confirming active exploitation against internet-facing management interfaces. Meanwhile, Cisco acknowledged that a newly revealed denial-of-service vulnerability in its classic and next-generation firewalls, CVE-2026-76418, is being actively exploited to reboot devices via crafted VPN connection requests, and it urges customers to apply the fix since no workaround exists.