www.it-connect.fr
PHP2Shell and Fragnesia: The Attack Chain That Delivered Root on 24 Firewalls
By combining the exploitation of PHP2Shell flaws and the Fragnesia vulnerability in the Linux kernel to compromise firewalls, cybercriminals managed to pull it off. Out of 240 targeted firewalls, 24 were compromised and the attackers managed to obtain root privileges. Here is what we know about these cyberattacks.
Things are still moving on the known security flaws front (including those already patched). The US CISA has just added CVE-2026-46300, aka Fragnesia, to its KEV (Known Exploited Vulnerabilities) catalog. That is not without consequences in the US: federal agencies must now patch it if they have not already done so, and the deadline is very short, since it is set for Saturday.
Fragnesia: the name probably rings a bell. It is a vulnerability discovered last May in the Linux kernel that provides local root access. It belongs to the Dirty Frag family of flaws and affects Linux kernels released before May 13, 2026. What must be understood here is that only Fragnesia requires local access to the machine.
That is where PHP2Shell comes in. These two critical flaws (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution and were patched on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA itself added them to the KEV catalog on Monday, October 26.
"This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and execute commands as root," the US agency says about Fragnesia. This means PHP2Shell and Fragnesia can be exploited together. PHP2Shell opens the server door, while Fragnesia hands over the keys by providing access to the root account.
25 devices compromised by these flaws
CISA considers these vulnerabilities exploited, and especially exploitable together, without going into details about the attacks. It is a Dream Security report that sheds light on the cyberattacks observed. Indeed, Dream Security researchers recovered the artifacts of a complete operation: a custom PHP2Shell exploit coupled with Fragnesia, target lists, logs, and about forty post-exploitation scripts.
The targets in question are not classic web servers running PHP, but firewalls from a major vendor whose name has not been disclosed (the vendor was notified). The administration interface runs on a more maintained version of PHP, namely PHP 8.0.30 (however, patches were applied).
Here is the scenario for this attack campaign:
- Reconnaissance and filtering: around 19,000 exposed firewalls were identified via FOFA, a Chinese search engine comparable to Shodan. After filtering potential targets (notably by version), only 240 firewalls were actually targeted, in the United States, Japan, Taiwan, and South Korea.
- Exploitation: PHP2Shell provides code execution as the nobody account, then Fragnesia overwrites the
/etc/pam.d/sufile in the page cache so thatsu rootworks without a password. All of this in less than 15 minutes. Result: 24 firewalls compromised, each infected with a PHP webshell. - Pivot: two of these firewalls belonged to an organization affiliated with the US government. Using a reverse SSH tunnel, the attacker compromised the firewall management server (counted as the 25th device), then went after Active Directory.
"An AD attack campaign was launched from the management server. Since the management server already had an LDAP connection to Active Directory (necessary to authenticate VPN users), the attacker used it as a launch platform to carry out attacks against the domain.", the report states.
Dream does not attribute the operation to a specific hacker group, but several clues point to an actor linked to China (starting with the use of FOFA and the use of the DeepSeek and Kimi models).
These are more reasons to protect yourself against the PHP2Shell and Fragnesia flaws. It would also be useful to know more about these firewalls... One technical detail, however, suggests Palo Alto Networks: the exploit targets the firewall's "appweb" management server. That is precisely where the PAN-OS administration interface's PHP scripts are located, under /var/appweb. The compromised management server would then point to Panorama. This is only a hypothesis, which neither Dream nor Palo Alto has confirmed. It is consistent with the Palo Alto security advisory, updated on October 29: PAN-OS and Panorama are listed among the products affected by PHP2Shell. “Active exploitation has been observed, targeting the Palo Alto Networks administration interface exposed on the Internet.”, the vendor says. More to come...
