China-Linked Hackers Exploit PHP2Shell to Root Firewalls

A China-linked threat actor chained PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) with the Fragnesia Linux kernel bug to gain root access to firewalls and deploy webshells. Using FOFA, the hackers found 19,000 exposed firewalls, exploited 25 on October 23-24 and dropped PHP root webshells on 24 devices, progressing further on two servers in a US government-affiliated environment.

• 25 firewalls targeted on October 23-24, root webshell dropped on 24 devices
• FOFA search found 19,000 exposed firewalls, narrowed to 240 targets
• Reverse SSH tunnel deployed on two servers in a US government-affiliated environment
• Attackers reached a management server and attempted Active Directory backdoor accounts