[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmbVjirnqKyhK0krBLbvK0gIsUNdPm1-spoeQNMO7G3Q":3},{"article":4,"iocs":56,"watch_terms":66,"solutions":67,"lesson":160},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"0bb83458-71ba-4fea-aa51-d548c2e54c16","Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers","suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-serve-1e6b96","Snoops 'likely still' have access to US government-affiliated network","Suspected Chinese threat actors have successfully breached 25 servers, including US government-affiliated Palo Alto Networks firewalls, by chaining a custom PHP2Shell exploit with a Linux kernel privilege-escalation vulnerability (Fragnesia). The attackers gained unauthenticated access via PHP2Shell and then escalated privileges using Fragnesia, leading to full Active Directory compromise on some networks. Researchers believe the attackers likely maintain persistent access to the compromised environments.","Chinese attackers exploit PHP2Shell and Linux kernel flaw to breach 25 servers, including US government-affiliated","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F10\u002F29\u002Fsuspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers\u002F5306456","https:\u002F\u002Fimage.theregister.com\u002F?imageId=5304691&width=800","2026-10-29T19:05:17+00:00","2026-10-29T20:00:23.387643+00:00",9,[17,20,23,25,28,31],{"name":18,"type":19},"Chinese attackers","threat_actor",{"name":21,"type":22},"PHP2Shell","product",{"name":24,"type":22},"PAN-OS",{"name":26,"type":27},"Palo Alto Networks","vendor",{"name":29,"type":30},"Linux kernel","technology",{"name":32,"type":30},"Active Directory","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":33,"icon":35,"name":36,"slug":37},null,"Nation-state","nation-state",[39,44,46,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61,63],{"type":58,"value":59,"context":60},"cve","CVE-2026-109618","PHP2Shell vulnerability",{"type":58,"value":62,"context":60},"CVE-2026-109619",{"type":58,"value":64,"context":65},"CVE-2026-46300","Fragnesia Linux kernel vulnerability",[26,21,24],{"controls":68,"vendors":155},[69,98,126],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":99,"name":100,"problem":101,"products":102},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":120,"vendor_name":26,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"palo-alto-networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":127,"name":128,"problem":129,"products":130},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[156],{"slug":120,"name":26,"logo_path":121,"roles":157},[158,159],"affected","reported_by",{"slug":161,"title":162,"body":163,"framework_refs":164,"framework_notes":172},"custom-php2shell-exploit-chains-with-kernel-flaw-to-root-25-servers","Custom PHP2Shell Exploit Chains with Kernel Flaw to Root 25 Servers","Suspected Chinese threat actors chained a custom PHP2Shell exploit with the Fragnesia Linux kernel privilege-escalation vulnerability to fully compromise 25 servers, including US government-affiliated infrastructure. The attack succeeded because internet-facing systems were left unpatched against known vulnerabilities, and unauthenticated access via PHP2Shell was not blocked or detected in time. The escalation to full Active Directory compromise on some networks shows the devastating downstream impact of a single unpatched entry point. This incident underscores that internet-facing appliances — including security devices like firewalls — are high-value targets that require the most aggressive patching and monitoring cadences.",[165,166,167,168,169,170,171],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":173,"NIST SP 800-53 SI-2: Flaw Remediation":174,"CIS Control 17: Incident Response Management":175,"OWASP A06:2021 Vulnerable and Outdated Components":176,"CIS Control 7: Continuous Vulnerability Management":177,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":178,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":179},"NIS2 mandates incident handling and vulnerability management practices for essential entities; US government-affiliated infrastructure subject to equivalent obligations should have had controls preventing unauthenticated exploitation of known CVEs.","SI-2 requires organisations to identify, report, and correct system flaws promptly; a disciplined flaw remediation process would have prevented the kernel privilege-escalation vulnerability from remaining exploitable on production servers.","Researchers believe the attackers retain persistent access, indicating the absence of a mature incident response process capable of fully evicting an adversary and verifying clean remediation across all 25 compromised servers.","The PHP2Shell exploit leveraged a vulnerable web component; OWASP A06 directly addresses the risk of running unpatched or outdated software components exposed to the internet.","Regular scanning and time-bound remediation of vulnerabilities on internet-facing assets would have identified and closed the PHP2Shell and Fragnesia flaws before attackers exploited them.","This control requires timely identification and remediation of technical vulnerabilities; adherence would have ensured the Fragnesia kernel flaw was patched before it could be chained into a full compromise.","The initial breach relied on unauthenticated access via PHP2Shell; enforcing authentication and access controls on internet-facing services would have blocked the attackers' entry point."]