China-Linked Hackers Exploit PHP2Shell to Root Firewalls

# China-Linked Hackers Exploit PHP2Shell to Root Firewalls

https://gcdradar.vercel.app/incidents/china-linked-hackers-exploit-php2shell-to-root-firewalls · AIR-2026-1619 · closed 2026-11-11

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed exploitation in the wild against a real target.
- Fix status: No fix needed
- First reported: 2026-10-28
- AI role: No AI role

## Summary

State-sponsored threat actors chained PHP2Shell and Fragnesia exploits to compromise two servers belonging to a US government-affiliated organization. The attacks resulted in unauthorized root access on the affected firewalls.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-28: China-Linked Hackers Exploit PHP2Shell to Root Firewalls (https://securityweek.com/china-linked-hackers-exploit-php2shell-to-root-firewalls)

## Sources

- 2026-10-28 SecurityWeek: China-Linked Hackers Exploit PHP2Shell to Root Firewalls https://securityweek.com/china-linked-hackers-exploit-php2shell-to-root-firewalls

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.