[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhqJxSQkcUZo61yd4nOUHv0utt65ucMroEPVlrEmWC4o":3},{"article":4,"iocs":56,"watch_terms":69,"solutions":70,"lesson":173},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"d7c9b062-c502-4b1f-9c56-dcfd860bf1ed","Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls","chinese-hackers-used-vmware-esx-zero-day-php2shell-and-fragnesia-chained-to-root-ff5b24","China-nexus threat actors have exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the “Fragnesia” Linux kernel bug to root servers and firewalls, cybersecurity researchers claim. Cisco has also confirmed that attackers are crashing its firewalls with a newly disclosed vulnerability. VMware ESX zero-day helped Chinese spies cover their tracks Chinese APT group Warp Panda has leveraged an insufficient logging vulnerability (CVE-2026-41709) in Broadcom’s VMware ESX bare-metal hypervisor as a … More → The post Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls appeared first on Help Net Security.","China-nexus threat actors, specifically APT group Warp Panda, have exploited a VMware ESX zero-day (CVE-2026-41709) to reduce audit trail visibility and maintain covert access. This vulnerability was added to CISA's KEV catalog. Additionally, a chain involving the Fragnesia Linux kernel bug (CVE-2026-46300) and PHP2Shell exploits has been used to gain root access on servers and firewalls, with attacks observed targeting Palo Alto Networks firewalls.","Chinese hackers exploit VMware ESX zero-day and chain Linux kernel bugs to root servers and firewalls.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F29\u002Fphp2shell-fragnesia-vmware-esx-zero-day\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2024\u002F11\u002F25153019\u002Fattack.webp","2026-10-29T16:25:10+00:00","2026-10-29T17:01:12.811417+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Warp Panda","threat_actor",{"name":21,"type":22},"VMware ESX","product",{"name":24,"type":25},"Broadcom","vendor",{"name":27,"type":22},"Palo Alto Networks firewalls",{"name":29,"type":25},"Cisco",{"name":31,"type":32},"Linux kernel","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":33,"icon":35,"name":36,"slug":37},null,"Nation-state","nation-state",[39,44,46,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61,64,67],{"type":58,"value":59,"context":60},"cve","CVE-2026-41709","VMware ESX insufficient logging vulnerability exploited by Warp Panda.",{"type":58,"value":62,"context":63},"CVE-2026-46300","Linux Kernel local privilege escalation vulnerability (Fragnesia).",{"type":58,"value":65,"context":66},"CVE-2026-109618","PHP2Shell exploit chain component.",{"type":58,"value":68,"context":66},"CVE-2026-109619",[24,29,21],{"controls":71,"vendors":159},[72,101,130],{"slug":73,"name":74,"problem":75,"products":76},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[77,85,93],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":102,"name":103,"problem":104,"products":105},"patch-management","Automated patch management","Known holes get closed in days, not months.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":131,"name":132,"problem":133,"products":134},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[135,143,151],{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":155,"product_name":156,"url":157,"description":158},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[160,165,171],{"slug":161,"name":29,"logo_path":162,"roles":163},"cisco","\u002Fvendor-logos\u002Fcisco.png",[164],"affected",{"slug":166,"name":167,"logo_path":168,"roles":169},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png",[170],"reported_by",{"slug":144,"name":145,"logo_path":146,"roles":172},[164],{"slug":174,"title":175,"body":176,"framework_refs":177,"framework_notes":185},"apt-group-exploits-vmware-esx-zero-day-and-chained-kernel-bugs-to-root-critical-infrastructure","APT Group Exploits VMware ESX Zero-Day and Chained Kernel Bugs to Root Critical Infrastructure","China-nexus threat actor Warp Panda leveraged a VMware ESX zero-day (CVE-2026-41709) alongside a chained exploit involving the Fragnesia Linux kernel bug and PHP2Shell to gain root-level access on servers and Palo Alto Networks firewalls. The attackers specifically targeted audit trail visibility, meaning defenders had reduced ability to detect and investigate the intrusion. Zero-day exploitation is especially dangerous on network perimeter devices because these assets are internet-facing, highly privileged, and often trusted implicitly within the environment. This incident underscores that critical infrastructure components — hypervisors, firewalls, and kernel-level systems — require aggressive patching timelines and compensating controls when patches are unavailable. The addition of these CVEs to CISA's KEV catalog signals an urgent, government-recognized threat demanding immediate remediation.",[178,179,180,181,182,183,184],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":186,"MITRE ATT&CK T1566: Phishing":187,"NIST SP 800-53 SI-2: Flaw Remediation":188,"CIS Control 17: Incident Response Management":189,"CIS Control 7: Continuous Vulnerability Management":190,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":191,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":192},"NIS2 mandates vulnerability handling and patch management policies for operators of essential services; compliance would have required structured, rapid response to these actively exploited CVEs on critical network infrastructure.","While the primary vector here is exploit chaining, MITRE ATT&CK's broader adversary technique framework — including T1190 (Exploit Public-Facing Application) — highlights the need to monitor and harden internet-exposed assets against initial access techniques used by APT groups like Warp Panda.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined schedule; a CISA KEV-aligned remediation process would have mandated urgent action on these zero-days.","A mature incident response plan with predefined playbooks for zero-day exploitation on critical network devices would have accelerated containment and reduced the window of covert access maintained by the threat actor.","Continuous vulnerability scanning with prioritized remediation deadlines would have flagged CVE-2026-41709 and CVE-2026-46300 as critical risks on internet-facing assets before Warp Panda could exploit them.","This control requires timely identification and remediation of technical vulnerabilities, which would have triggered an emergency response to patch or mitigate the VMware ESX and Linux kernel flaws before exploitation.","Restricting and monitoring privileged root-level access on hypervisors and firewalls would have limited the attacker's ability to maintain covert access after exploiting the zero-day."]