Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers
Chinese attackers exploit PHP2Shell and Linux kernel flaw to breach 25 servers, including US government-affiliated
Suspected Chinese threat actors have successfully breached 25 servers, including US government-affiliated Palo Alto Networks firewalls, by chaining a custom PHP2Shell exploit with a Linux kernel privilege-escalation vulnerability (Fragnesia). The attackers gained unauthenticated access via PHP2Shell and then escalated privileges using Fragnesia, leading to full Active Directory compromise on some networks. Researchers believe the attackers likely maintain persistent access to the compromised environments.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Palo Alto Networks?
Get an email when a new story names Palo Alto Networks, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonSuspected Chinese threat actors chained a custom PHP2Shell exploit with the Fragnesia Linux kernel privilege-escalation vulnerability to fully compromise 25 servers, including US government-affiliated infrastructure. The attack succeeded because internet-facing systems were left unpatched against known vulnerabilities, and unauthenticated access via PHP2Shell was not blocked or detected in time. The escalation to full Active Directory compromise on some networks shows the devastating downstream impact of a single unpatched entry point. This incident underscores that internet-facing appliances — including security devices like firewalls — are high-value targets that require the most aggressive patching and monitoring cadences.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-109618
- cve — CVE-2026-109619
- cve — CVE-2026-46300