Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls

China-nexus threat actor Warp Panda leveraged a VMware ESX zero-day (CVE-2026-41709) alongside a chained exploit involving the Fragnesia Linux kernel bug and PHP2Shell to gain root-level access on servers and Palo Alto Networks firewalls. The attackers specifically targeted audit trail visibility, meaning defenders had reduced ability to detect and investigate the intrusion. Zero-day exploitation is especially dangerous on network perimeter devices because these assets are internet-facing, highly privileged, and often trusted implicitly within the environment. This incident underscores that critical infrastructure components — hypervisors, firewalls, and kernel-level systems — require aggressive patching timelines and compensating controls when patches are unavailable. The addition of these CVEs to CISA's KEV catalog signals an urgent, government-recognized threat demanding immediate remediation.