Researchers at Israeli firm Dream disclosed an observed 25 October attack in which a suspected China-nexus actor combined the PHP2Shell flaws — CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), unauthenticated PHP RCE — with "Fragnesia", a Linux-kernel local privilege escalation (CVE-2026-46300, CVSS 7.8), to root 25 servers running a major vendor's firewall software, including three systems in a US government-affiliated environment, before moving against Active Directory; recovered artefacts confirm credential extraction and directory enumeration.