PHP2Shell Plus Fragnesia: 24 Firewalls Rooted in Under 15 Minutes Each, and CISA Just Added the Kernel Bug

I've been updating my PHP2Shell post every day this week. This one gets its own post, because it's the clearest picture yet of what PHP2Shell looks like in a real intrusion, and it ends with the attacker inside Active Directory.

Dream Research published it on October 26. CISA added the kernel bug in the chain, CVE-2026-46300 (Fragnesia), to its Known Exploited Vulnerabilities catalog on October 28, with a federal deadline of October 31. And the PHP2Shell KEV deadline is today.

The Chain

• Step 1, PHP2Shell. A custom, non-public exploit for CVE-2026-109618 and CVE-2026-109619 against the PHP-based management web server on a firewall (running PHP 8.0.30, which is long out of support). That gets code execution as nobody.
• Step 2, Fragnesia. SELinux kept nobody boxed in, so the attacker used CVE-2026-46300, a Linux kernel flaw in XFRM ESP-in-TCP that can write into the page cache of read-only files. They overwrote /etc/pam.d/su so su root works without a password.
• Result: a root webshell in under 15 minutes per device.

The Funnel

This is what industrialized looks like:

• About 19,000 internet-facing firewalls found through FOFA.
• About 5,000 answered version fingerprinting.
• 240 targets after filtering to four countries (the U.S., Japan, Taiwan and South Korea) and matching versions.
• 24 rooted by the automated batch, plus an internal firewall management server reached later through a reverse SSH tunnel. 25 total.

Three were in a U.S. government-affiliated environment. Dream hasn't named the firewall vendor and says the vendor has been notified. I'm not going to guess.

Then It Got Worse

On the management server, the attacker decrypted an LDAP service account password using the device's master key, enumerated every user and group, recovered private keys and the full network topology, and then tried a password spray, backdoor accounts and SAML signing key extraction. Dream can't confirm whether those last steps worked. It did note an account lockout threshold of zero, which meant the spray had no limit.

This is the part people miss about edge devices. The firewall isn't the prize. The firewall is the thing that holds the credentials to your directory.

The AI Angle

Dream found Claude Code installed on the attack infrastructure and an offensive platform configured with DeepSeek and Kimi models, plus around 40 scripts it says look AI-assisted. It has no direct proof that AI wrote the exploit, and it doesn't think the operation was fully autonomous. Attribution points to a Chinese nexus (target selection, FOFA, tooling, UTC+8 timestamps, Chinese-language prompts), but no named actor.

What To Do

• Patch PHP everywhere, including inside appliances. PHP2Shell's KEV deadline is today. If a vendor ships PHP in its management interface, ask for its fixed build and timeline.
• Patch the kernel for Fragnesia. Get CVE-2026-46300 fixes from your distro. If you can't patch yet and don't use IPsec, unloading the esp4 and esp6 modules is a reported stopgap, but test it first, because it breaks IPsec VPNs.
• Take management interfaces off the internet. Dream's own words: this one "should never have been exposed to the internet." I agree.
• Hunt on the devices. Look for small PHP files in web-accessible directories, changes to /etc/pam.d/su (especially pam_permit.so), unexpected systemd services or rc.local entries, and outbound SSH tunnels.
• Assume the directory is in scope. Rotate the service account credentials your firewalls and their management servers use, set a real lockout threshold, and check SAML settings such as IdP certificate validation.

One more KEV note from the same October 28 batch: CISA also added CVE-2026-41709, a VMware ESX bug that lets a malicious admin perform some actions without logging them. It doesn't grant access by itself, but it's exactly what an attacker who already has admin wants. Federal deadline November 11.

Bottom Line

Two bugs, one HTTP request, root on a firewall, and then a straight line into Active Directory. If your security appliance's admin page is on the internet, it isn't protecting your network. It's a door into it.

Sources: Dream Research, Cyber Press, SecurityOnline on the KEV additions, GBHackers on CVE-2026-41709, and LinuxSecurity on Fragnesia