If PHP2Shell wasn’t already at the top of your patch list, this should put it there.
Security firm Dream reports that a China-linked threat actor has been chaining exploits for the two PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with Fragnesia, a Linux kernel privilege escalation bug tracked as CVE-2026-46300. The result is root access on internet-facing firewalls, SecurityWeek reports.
How the campaign worked
According to Dream, the attackers used the Chinese internet asset search engine FOFA to find 19,000 internet-facing firewalls from one vendor. They narrowed the list to devices in the US, Japan, Taiwan and South Korea running newer PHP releases, leaving 240 potential targets.
An automated tool then fired the full exploit chain, dropping a root PHP webshell on 24 devices on October 23 and 24. On two servers belonging to a US government-affiliated environment, the attackers went further. They set up a reverse SSH tunnel, used the same chain against an internal firewall management server, and gained access to the configurations, credentials and settings of every firewall the organization managed.
From there, Dream says, they decrypted an LDAP service account password, enumerated domain users and groups, ran password spraying and tried to create Active Directory backdoor accounts. Dream hasn’t named a specific group but believes it is a Chinese-nexus operation.
CISA’s deadline is tight
CISA added Fragnesia to its Known Exploited Vulnerabilities catalog on October 28, noting it can be chained with the PHP2Shell flaws to implant webshells and run commands as root. Federal agencies have until October 31 to act, and CISA flagged it as requiring forensic triage. The agency also added a VMware ESXi insufficient logging flaw, CVE-2026-41709, the same day.
CISA has urged organizations to update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Why it matters
Network appliances keep proving to be the soft spot in enterprise defenses, and this chain turns a web-layer bug into full control of security infrastructure. Patch PHP, patch the kernel, and check edge devices for webshells, not just your web servers.
For security vendors and MSSPs, incidents like this create urgent, budget-backed demand for exposure management, compromise assessments and managed detection. Reaching infrastructure and security leaders while the deadline is fresh is when outreach lands best.
Sources: SecurityWeek, CISA, CISA KEV Catalog, CISA PHP alert. Written by the xRapid Media LLP team.
Selling to the IT market? xRapid Media LLP is a High Tech B2B Marketing company. We help technology companies reach decision-makers with verified B2B data, account-based campaigns, email and LinkedIn outreach and appointment setting. Call +91 9767196309 or book a free B2B marketing consultation.