China-Linked Hackers Exploit PHP2Shell to Root Firewalls

A China-linked threat actor has been exploiting thePHP2Shellvulnerabilities to gain root access to firewalls and deploy webshells for persistent access, cybersecurity firm Dream reports.

The hackers have been chaining an exploit for the two PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619, with another for Fragnesia, a privilege escalation bug in the Linux kernel tracked as CVE-2026-46300.

As part of the observed attacks, the hackers used the Chinese internet asset search engine FOFA to identify 19,000 internet-facing firewalls from a specific vendor, and proceeded to exploit 25 of them on October 23-24, Dream says.

After discovery, the hackers first filtered servers in the US, Japan, Taiwan, and South Korea, then filtered those running newer PHP releases, which gave them a pool of 240 potential targets.

Using an automated tool, the attackers then targeted the firewalls with the full PHP2Shell-Fragnesia exploit chain, dropping a PHP root webshell on...

Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE