A China-linked threat actor exploited PHP2Shell vulnerabilities to gain root access to firewalls and deploy webshells, targeting two servers of a US government-affiliated organization.
The vulnerability or weakness
The attackers chained exploits for PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with another for Fragnesia, CVE-2026-46300, to gain root access.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-109618 | 9.2 | CRITICAL | Yes, added 2026-10-26 | 2026-10-29 |
| CVE-2026-109619 | 9.2 | CRITICAL | Yes, added 2026-10-26 | 2026-10-29 |
| CVE-2026-46300 | 7.8 | HIGH | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Linux Flaws Exposed Before Fixes as Root Exploit Goes Public (2026-10-26)
- Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials (2026-10-23)
- Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed (2026-10-22)
- China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack (2026-10-22)
- Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor (2026-10-19)
Business impact
The compromise could lead to unauthorized access, data theft, and potential operational disruptions for affected organizations, especially those in strategic regions.
Industries affected
The incident primarily affects government-affiliated organizations, critical infrastructure, and entities in the Pacific theater.
Users affected
Users of the affected firewalls and internal management servers may have their credentials and settings compromised, leading to potential unauthorized access.
Build these skills
Sources
- China-Linked Hackers Exploit PHP2Shell to Root Firewalls (SecurityWeek)
