Suspected Chinese Actor Roots 25 Servers via Custom PHP2Shell Exploit

Cybersecurity researchers disclosed details of an AI-assisted attack orchestrated by a suspected China-nexus threat actor. The activity was observed on October 25, 2026. The attacker leveraged PHP2Shell vulnerabilities to breach exposed systems. The attacker combined PHP2Shell with a kernel privilege escalation exploit to root 25 servers. Three of the rooted systems were in a U.S. government-affiliated environment. The affected devices ran specific versions of a large vendor's firewall software. The custom weaponization of the exploit chain rooted 25 servers across the U.S., Japan, Taiwan, and South Korea.

The PHP2Shell implementation recovered was a custom, non-public build independently developed for the targeted firewall platform. The vulnerability targets PHP's session.upload_progress mechanism on the firewall's appweb management server. PHP2Shell consists of two flaws tracked as CVE-2026-109618 and CVE-2026-109619 with CVSS scores of 9.2. Fragnesia is a Linux kernel local privilege escalation vulnerability tracked as CVE-2026-46300 with a CVSS score of 7.8. The attacker launched attacks against Active Directory after gaining access. Recovered artifacts confirmed credential extraction and directory enumeration.

Evidence points to the installation of Anthropic's Claude Code in the attack infrastructure. API keys for FOFA and an AI-powered offensive security platform called aiscan were configured with LLMs from DeepSeek and Kimi. The attacker used FOFA to identify approximately 19,000 internet-facing firewalls with exposed management interfaces worldwide. Palo Alto Networks warned that threat actors are exploiting recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. Active exploitation targeting Palo Alto Networks management interfaces was observed by the network security company.

CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) catalog. Federal agencies are required to apply fixes for CVE-2026-46300 by October 31, 2026.