Chained PHP2Shell and Fragnesia Exploit Campaign Analysis

Executive Summary

A coordinated, likely state-aligned cyber campaign has successfully compromised 25 servers, including systems within a US government-affiliated environment, by chaining a custom PHP2Shell exploit with a Linux kernel privilege escalation. The attackers utilized automated reconnaissance and version-specific exploit profiles to pivot from perimeter firewalls into internal identity infrastructure, demonstrating a high degree of operational maturity.

The Attack Chain: PHP2Shell and Fragnesia

The attackers developed a two-stage exploit chain capable of achieving root access on targeted firewalls via a single, unauthenticated HTTP request. This chain bypasses standard security controls by combining memory corruption with kernel-level privilege escalation.

PHP2Shell (CVE-2026-109618 / CVE-2026-109619)

This component targets the session.upload_progress mechanism in PHP 8.0.30. The attack executes in four distinct phases:

Memory Exhaustion: Flooding the server with large multipart POST requests to force a predictable memory layout.
Information Leak: Triggering an out-of-bounds read to leak the base address of libphp.so.
Stale Reference Setup: Creating a forged zend_reference in memory.
Code Execution: Forging a PHP HashTable entry to point to zif_system, executing arbitrary commands as the nobody user.

Fragnesia (CVE-2026-46300)

Because the initial code execution is confined by SELinux, the attackers chained a second exploit targeting the Linux kernel's XFRM ESP-in-TCP subsystem. This allows the attacker to overwrite /etc/pam.d/su with pam_permit.so, enabling passwordless root access via su root.

Operational Methodology

The attackers employed a structured, automated funnel to identify and compromise targets, moving from broad discovery to high-value exploitation.

Targeting: Using the FOFA search engine, the attackers identified 19,000 internet-facing firewalls. They filtered these down to 240 high-value targets in the US, Japan, Taiwan, and South Korea.
Version Profiling: The attackers maintained 11 JSON-based version profiles. These profiles contained precise memory offsets and geometry parameters for different firewall OS versions, allowing for automated, reliable exploitation.
Persistence and Pivot: Once a firewall was rooted, the attackers established a persistent reverse SSH tunnel. This provided access to internal management servers, which were then used to launch attacks against Active Directory, including credential extraction and user enumeration.

AI-Assisted Development

While the operation does not appear to be fully autonomous, evidence suggests significant AI assistance in the development of the exploit infrastructure. Artifacts recovered include configurations for the aiscan platform using DeepSeek and Kimi LLMs, as well as the presence of Claude Code. The consistency across approximately 40 custom post-exploitation scripts indicates that AI likely aided in code structure and generation.

Community Insights and Discussion

Discussion within the security community highlights several critical takeaways regarding the nature of this breach:

Exposure Risks: Commenters emphasized that management interfaces for critical infrastructure like firewalls should never be exposed to the public internet and should instead reside on isolated management VLANs.
Vendor Speculation: While the researchers did not disclose the vendor, community members have speculated that the configuration details and SELinux behaviors are consistent with major firewall providers like Palo Alto Networks or Fortinet.
Exploit Complexity: Some observers noted that the memory exhaustion technique used to achieve the initial RCE is surprisingly manual, suggesting that while the attackers are well-funded, they are still refining their exploit development processes.
Attribution: Indicators such as the use of Chinese-language LLMs, Chinese internet infrastructure (FOFA), and UTC+8 timestamps strongly suggest a Chinese-nexus operation, though researchers have not formally attributed the attack to a specific state actor.