Suspected Chinese Attackers Chain Two Flaws to Take Over 25 Servers, Including Government-Linked Firewalls

Suspected Chinese attackers chained the PHP2Shell vulnerabilities with a Linux kernel privilege-escalation flaw called Fragnesia to gain full control of 25 servers, according to researchers at Dream. The targets included Palo Alto Networks firewalls linked to US government-affiliated organisations. Attacks began on October 23 and hit organisations in the US, Japan, Taiwan and South Korea. Dream says the attackers likely still have persistent remote access to compromised networks.

Dream reported that, within hours of compromising one government-affiliated firewall, the attackers tunnelled into the internal network, compromised a third server and launched an Active Directory attack campaign. The chain started with a single unauthenticated web request to a management interface that should never have been exposed to the internet. The firewalls were running vulnerable versions of PAN-OS. Palo Alto Networks' Unit 42 independently verified the attackers' tooling and confirmed Dream's results. The attackers also ran about 40 custom scripts after getting inside.

PHP2Shell is made up of CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS severity scale. Either can be used without logging in to run code on vulnerable PHP servers. The bugs surfaced early last week, and although hundreds of proof-of-concept repositories appeared on GitHub, the first reports of successful attacks only began on Saturday.