PHP2Shell / Fragnesia: internet-facing firewalls — China-linked hackers chain PHP RCE with Linux kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)
Severity: critical · Patch status: unknown · Since 2026-10-28 · CVE-2026-109618, CVE-2026-109619, CVE-2026-46300
Dream reports a China-linked threat actor chaining two PHP flaws (PHP2Shell, CVE-2026-109618 and CVE-2026-109619) with a Linux kernel privilege escalation bug (Fragnesia, CVE-2026-46300) to gain root access to internet-facing firewalls and deploy PHP root webshells. Using the FOFA search engine, attackers identified ~19,000 firewalls from one vendor, filtered targets in the US, Japan, Taiwan and South Korea running newer PHP, and on October 23-24 exploited 25 devices with an automated tool, rooting 24. On two servers tied to a US government-affiliated organization, they deployed a reverse SSH tunnel, pivoted to an internal firewall management server, stole configurations and credentials, decrypted an LDAP service account password, enumerated the domain, performed password spraying, and attempted AD backdoor accounts. No specific actor attribution or patch status was given.
What to do
- Identify internet-facing firewalls and PHP-enabled services and check for webshells and reverse SSH tunnels
- Apply vendor patches for the PHP2Shell flaws and the Fragnesia kernel bug as soon as available; mitigate exposure via firewalling and disabling unnecessary PHP endpoints
- Rotate credentials stored on firewall management servers, including LDAP service accounts, and audit for suspicious AD accounts
- Review firewall management server access logs and configurations for tampering
- Monitor for FOFA-indexed exposure and remove management interfaces from the public internet
Sources
All live incidents on Threat Watch
