Hackers have secured administrator-level root control over 25 servers across the United States, Japan, Taiwan, and South Korea by chaining two PHP2Shell vulnerabilities with a Linux Kernel security flaw. The sophisticated cyberattack focused on internet-facing firewall management appliances, including three sensitive systems operating inside an environment tied to an organization affiliated with the United States government. Forensic inquiries indicate that following the perimeter intrusion, the threat actors attempted to penetrate internal networks to extract user profiles, group records, and administrative configurations from Active Directory installations.
Custom Exploit Chain Bypasses Perimeter Security
Investigators examining files retrieved on October 25 identified tailored exploit tools, reconnaissance logs, and nearly 40 post-compromise scripts that outline the multi-phase intrusion method. The compromised platform developer has been alerted to the security flaws, though the vendor name and vulnerable firmware editions remain undisclosed to prevent wider exploitation. The attack combined two distinct entry flaws, identified as CVE-2026-109618 and CVE-2026-109619, alongside a Linux Kernel privilege escalation vulnerability designated as Fragnesia, tracked as CVE-2026-46300.
Rather than relying on public exploit frameworks, the operators authored a bespoke implementation tailored specifically for the target firewall’s Appweb Management Server. The code targeted PHP’s Session Upload Progress mechanism, intentionally draining system memory buffers before leaking internal memory addresses and manipulating altered data structures. This allowed attackers to run execution commands under the restricted “nobody” system account. They subsequently executed the Fragnesia flaw to overwrite local authentication data, achieving complete root privileges without providing passwords and deploying a root webshell within fifteen minutes to maintain remote administrative oversight.
Reconnaissance Targets Thousands of Internet Gateways
Initial reconnaissance relied on the FOFA indexing engine to scan for accessible enterprise firewall interfaces, locating approximately 19,000 exposed systems worldwide. Attackers filtered through approximately 5,000 gateways displaying discernible version indicators, ultimately winnowing the pool down to 240 high-probability targets matching specific geographic and firmware profiles. A total of 24 appliances were breached during the primary sweep, with root webshells established on 22 devices where no further lateral movement was observed.
The perpetrators directed their primary operational focus toward higher-value targets, most notably two edge devices managing traffic for an American government-affiliated body. System files extracted from the initial compromised unit exposed internal network architecture and secondary server records. When that gateway unexpectedly crashed, the intruders targeted a companion firewall at the same entity on October 24, establishing a persistent reverse SSH tunnel configured to survive hardware reboots across eight internal communication ports. That evening, attackers routed the identical dual-exploit sequence through the encrypted tunnel to compromise an internal management node, marking the 25th penetrated system and jeopardizing centralized firewall credentials.
Attackers Probe Directory Services and Digital Identities
Once internal network visibility was established, the intruders successfully deciphered an LDAP service account password and enumerated user groups within the central Active Directory environment. Researchers cataloged several credential-harvesting maneuvers, such as password spraying runs, rogue administrative account creation, and attempts to extract SAML certificate signing keys. The definitive success of these identity operations remains unconfirmed, leaving it uncertain whether the operators secured domain dominance.
Investigators also recovered references to Claude Code alongside automated scanning utilities tied to DeepSeek and Kimi model environments on compromised hosts. Linguistic markers featuring Chinese-language prompts and timestamps aligned with the UTC+8 timezone point toward regional origin, yet researchers uncovered no verifiable evidence attributing the campaign to a specific group or confirming automated exploit generation. Security experts advise that applying vendor patches addresses only the initial vulnerability points, urging system administrators to conduct rigorous forensic audits for orphaned webshells, rogue accounts, and active tunnels left behind across internal networks.
