China-Linked Hackers Exploit PHP2Shell to Root Firewalls

What it is

A China-linked actor chained the PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619) with the Linux kernel privilege escalation Fragnesia (CVE-2026-46300) to root internet-facing firewalls from one unnamed vendor. Dream reported it. The tooling was automated and dropped a PHP root webshell for persistence. Dream has not named a specific threat actor but believes the operation is Chinese-nexus.

How it works

Targeting was narrowed in stages. The actor used the FOFA search engine to find 19,000 internet-facing firewalls from the vendor. It then kept only devices in the US, Japan, Taiwan and South Korea, and then only those running newer PHP releases. That left 240 candidates.

An automated tool ran the full PHP2Shell-Fragnesia chain against them. The page says 25 firewalls were exploited on 23-24 October and 24 received the root webshell. No post-exploitation activity was seen on 22 of those 24.

The other two belonged to a US government-affiliated environment. The first crashed soon after exploitation on 23 October. The actor sent 240 automated probes over two hours waiting for it to recover, and it did not. A second firewall had timed out in the original batch, and its certificate data tied it to the target organization. The actor exploited it successfully in a second wave on 24 October.

From there the actor:

1. Set up a reverse SSH tunnel to keep access.
2. Ran the same chain against the internal firewall management server, which exposed the configurations, credentials and settings of every firewall the organization managed.
3. Used the management server to decrypt the LDAP service account password and enumerate domain users and groups.
4. Ran password spraying and tried to create Active Directory backdoor accounts, among other actions.

Preconditions / Affected

• A firewall from the unnamed vendor with internet-facing exposure and a newer PHP release. The actor filtered for this, which suggests older PHP builds were less useful to it, though the page does not say why.
• A management server reachable from a compromised firewall, which turned one device into control of a whole fleet.
• An LDAP service account whose password the management server could decrypt.

Caveats

• The page does not name the vendor or product, give affected versions, or list patches, mitigations or indicators of compromise. An engineer cannot tell from it whether their own devices are in scope.
• The counts are inconsistent in the text: 25 exploited and 24 webshells. The summary's figure of 24 rooted matches the webshell count.
• The state-aligned attribution rests on Dream's reasoning that the four target countries are Chinese strategic adversaries. Dream does not tie it to a named group.