Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls
China-nexus threat actors have exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the “Fragnesia” Linux kernel bug to root servers and firewalls, cybersecurity researchers claim.
Cisco has also confirmed that attackers are crashing its firewalls with a newly disclosed vulnerability.
VMware ESX zero-day helped Chinese spies cover their tracks
Chinese APT group Warp Panda has leveraged an insufficient logging vulnerability (CVE-2026-41709) in Broadcom’s VMware ESX bare-metal hypervisor as a zero-day, a new CrowdStrike report revealed.
CVE-2026-41709 was publicly disclosed and fixed by Broadcom in July 2026. Broadcom thanked CrowdStrike researcher Ian Barton for reporting the issue.
CrowdStrike now says that the latest intrusion where it saw Warp Panda exploiting CVE-2026-41709 happened in early 2026, and that the flaw uallowed the group to significantly reduce audit trail visibility.
“WARP PANDA represents a sustained and strategically focused China-nexus cyber espionage threat to U.S. entities across multiple sectors, including the legal sector. The adversary typically exploits internet-facing edge devices to gain initial access, then pivots to VMware vCenter environments to deploy custom malware such as BRICKSTORM and SharpStorm, maintaining persistent covert access for extended periods of time,” CrowdStrike explained.
“The legal sector’s concentration of client communications, merger and acquisition materials, active litigation strategy, and cross-client access makes it a high-value collection target for a state-directed adversary seeking intelligence with downstream operational utility.”
The group has also been breaking into Microsoft 365 environments by obtaining user session tokens and occasionally registering a new MFA device on a compromised account.
The US Cybersecurity and Infrastructure Security Agency added CVE-2026-41709 to its Known Exploited Vulnerabilities (KEV) catalog on October 28, 2026, and has ordered US federal civilian agencies to address it by November 11.
Linux kernel flaw joins PHP2Shell exploit chain
CVE-2026-46300 (aka “Fragnesia”), a Linux Kernel local privilege escalation vulnerability disclosed in May 2026, was also added to CISA’s KEV catalog on Wednesday. That one should be addressed by October 31, CISA saya, and comes with the forensic triage requirement mandated by BOD 26-04.
“This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root,” the agency noted.
According to cybersecurity outfit Dream, that’s what a China-nexus threat actor did in an AI-assisted campaign that rooted 25 firewalls, then planted webshells and extracted credentials from the Active Directory domain controllers.
“Dream researchers identified a complete attack operation that included a custom weaponization of the PHP2Shell exploit chain (CVE-2026-109618/CVE-2026-109619) paired with the Fragnesia kernel privilege escalation (CVE-2026-46300), target lists, exploitation logs, and approximately 40 custom post-exploitation scripts,” the company said.
“This included artifacts of a campaign that had rooted 25 servers across the United States, Japan, Taiwan, and South Korea. Once rooted, the attacker zeroed in on three specific servers in a US government-affiliated environment.”
The attack path (Source: Dream)
Dream did not name the maker of the rooted firewalls. But, whether a coincidence or not, Palo Alto Networks updated its PHP2Shell-related advisory today to say that “active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet”.
Security researcher Kevin Beaumont also said that he’s “aware of a ransomware group using PHP2Shell against Palo-Alto firewalls to gain initial access to [organizations],” and mentioned reports about a Chinese national state group exploiting PHP2Shell vulnerabilities to get on Palo Alto Networks firewalls for espionage against the US government.
Help Net Security has reached out to Palo Alto Networks for more information and we’ll update this article when we hear back from them. In the meantime, their customers should consult the advisory for advice on how to protect their boxes.
Attackers exploit Cisco firewall DoS flaw
Cisco confirmed today that a newly disclosed vulnerability (CVE-2026-76418) affecting its “classic” and next-gen firewalls has been exploited to crash devices.
“This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. [An unauthenticated, remote] attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition,” the company stated, and said that its Product Security Incident Response Team became aware of active exploitation of this vulnerability in October 2026.
Since there are no available workarounds, Cisco “strongly recommends” that customers upgrade to a fixed software release to remediate the flaw.
CVE-2026-76418 has yet to be added to CISA’s Known Exploited Vulnerabilities catalog.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
