APT Exploits PHP2Shell & Fragnesia to Root Firewalls

Executive Summary

A sophisticated threat actor, assessed to be linked to China, is conducting a targeted campaign against internet-facing firewalls. The attackers are leveraging a potent exploit chain that combines the PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with a Linux privilege escalation flaw dubbed Fragnesia (CVE-2026-46300). This combination enables the Advanced Persistent Threat (APT) group to achieve full root-level control of the devices. Post-exploitation activity includes the installation of PHP root webshells and reverse SSH tunnels to maintain persistent access. The campaign has successfully compromised multiple targets, including at least one firewall belonging to a U.S. government-affiliated entity.

Threat Overview

The campaign demonstrates a methodical approach, beginning with broad reconnaissance and progressively narrowing the target set. The threat actor utilized the Chinese internet asset search engine FOFA to identify approximately 19,000 firewalls from an unnamed vendor. This list was then filtered to focus on devices located in the United States, Japan, Taiwan, and South Korea that were running vulnerable versions of PHP, resulting in a refined list of about 240 high-value targets.

Between October 23 and 24, 2026, the APT group launched automated attacks, successfully compromising 25 of these firewalls. In 24 cases, the attackers deployed a PHP webshell to ensure persistent access. While most compromised devices saw no further activity, the attackers escalated their efforts against two firewalls belonging to a U.S. government-affiliated organization. After one device crashed post-exploitation, the attackers pivoted to the second, where they established a reverse SSH tunnel to solidify their foothold, indicating a more determined objective against this specific target.

Technical Analysis

The attack relies on a three-stage exploit chain to move from external scanning to full system control:

1. Initial Access - RCE via PHP2Shell: The attackers exploit CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. These critical vulnerabilities in PHP allow for remote code execution on the targeted firewall, giving the actor an initial foothold on the system as the web server user. This aligns with T1190 - Exploit Public-Facing Application.

2. Privilege Escalation - Fragnesia: With initial access, the actor then exploits CVE-2026-46300 (Fragnesia), a vulnerability in the Linux kernel, to escalate privileges from the web server user to root. This gives them complete control over the underlying operating system of the firewall. This is a classic example of T1068 - Exploitation for Privilege Escalation.

3. Persistence - Webshell & SSH Tunnel: To maintain long-term access, the attackers deploy two mechanisms:

   • A PHP root webshell, which allows them to execute commands with root privileges at any time via a hidden web interface (T1505.003 - Server Software Component: Web Shell).
   • A reverse SSH tunnel, which creates a persistent, encrypted outbound connection from the compromised firewall to an attacker-controlled server. This bypasses inbound firewall rules and provides a stable C2 channel (T1090.002 - Proxy: External Proxy).

Impact Assessment

The compromise of a perimeter firewall represents a catastrophic security failure. As the primary boundary between an organization's internal network and the internet, a compromised firewall grants an attacker a powerful position to:

• Monitor, intercept, or modify all network traffic passing through it.
• Pivot deeper into the internal network, bypassing other security controls.
• Use the firewall as a launchpad for attacks against other organizations, obscuring the true origin of the attack.

The targeting of a U.S. government-affiliated organization suggests espionage as a potential motive. The establishment of a reverse SSH tunnel indicates a desire for long-term, stealthy access, likely for data exfiltration or to maintain a foothold for future operations.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) such as IP addresses, domains, or file hashes were mentioned in the source articles.

Cyber Observables — Hunting Hints

The following patterns could indicate related activity:

Detection & Response

• Vulnerability Scanning: Immediately scan all internet-facing devices for CVE-2026-109618, CVE-2026-109619, and CVE-2026-46300.
• Log Review: Analyze web server access logs on firewalls for suspicious requests matching the timeframe of the attack (October 23-24). Scrutinize logs for evidence of the PHP2Shell exploit.
• Egress Traffic Analysis: Implement Network Traffic Analysis (D3-NTA) to detect anomalous outbound connections from network infrastructure devices. A firewall making an outbound SSH connection is highly suspicious and should be investigated immediately.
• File Integrity Monitoring: Use File Integrity Monitoring (D3-SFA) on firewall devices to alert on the creation of new files in web directories, which could indicate webshell deployment.

Mitigation

• Patching: The most critical mitigation is to apply the security updates from the firewall vendor that address these vulnerabilities (D3-SU). Given the active exploitation, this should be treated as an emergency change.
• Restrict Management Access: Limit access to the firewall's management interface to a trusted, internal management network. It should not be exposed to the internet.
• Egress Filtering: Configure firewall rules to block all outbound traffic from the firewall itself, except for what is explicitly required for its operation (e.g., NTP, DNS). This can prevent reverse SSH tunnels from being established.
• Web Application Firewall (WAF): Place a WAF in front of the firewall's management interface (if it must be exposed) to filter for malicious requests that could indicate exploitation attempts.