Researchers at Israeli firm Dream disclosed an observed 25 October attack in which a suspected China-nexus actor combined the PHP2Shell flaws — CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), unauthenticated PHP RCE — with "Fragnesia", a Linux-kernel local privilege escalation (CVE-2026-46300, CVSS 7.8), to root 25 servers running a major vendor's firewall software, including three systems in a US government-affiliated environment, before moving against Active Directory; recovered artefacts confirm credential extraction and directory enumeration. Dream says the exploit was a custom, non-public build tailored to the firewall platform — evidence of AI-assisted, per-target exploit development. The same day, CISA added Fragnesia and a VMware ESX logging flaw (CVE-2026-41709) to its KEV catalogue. The campaign validates the ACSC's 21 October PHP alert as a live-threat instruction, and the kernel-leg pairing marks PHP2Shell as a chained-exploit ecosystem, not a single fix.

• Source article