View Ridge Security
Back to Cyber Hose

Chained PHP2Shell exploits root 25 servers, including US government

Chained PHP2Shell exploits root 25 servers including US government systems; WatchGuard discloses 7 critical Fireware OS flaws; CISA adds VMware ESX flaw to KEV.

🚨 ACTIVE EXPLOITATION

  • Chained PHP2Shell and Linux kernel exploits root 25 servers, including US government systems
    Hackers chained PHP2Shell and a Linux kernel privilege escalation exploit to gain root access on 25 servers, including US government-affiliated systems.
    • Targets were internet-exposed firewall management interfaces running PHP 8.0.30 across the US, Japan, Taiwan, and South Korea; 24 firewalls were rooted, with 22 left with webshells.
    • The chain paired PHP2Shell (CVE-2026-109618/CVE-2026-109619), a custom RCE exploiting PHP's session.upload_progress on the appweb management server, with Fragnesia (CVE-2026-46300), a kernel LPE in the XFRM ESP-in-TCP subsystem.
    • PHP2Shell works in four stages: memory exhaustion, an out-of-bounds read leaking the libphp.so base address, stale reference setup, and forged HashTable execution as the nobody user; Fragnesia overwrites /etc/pam.d/su with pam_permit.so for passwordless root.
    • FOFA reconnaissance identified ~19,000 exposed firewalls, narrowed to 240 targets; the full chain from unauthenticated HTTPS to persistent root webshell took under 15 minutes.
    • Recovered artifacts included Claude Code, an aiscan setup using DeepSeek and Kimi LLMs, and ~40 post-exploitation scripts; the attacker pivoted via reverse SSH tunnel to Active Directory, extracting an LDAP service account password and enumerating users.
    Sources 📎 Coverage: dreamgroup.com · 👁 via Cyber Security News, cryptika.com (discovered)

📋 ADVISORIES

  • WatchGuard discloses 7 critical Fireware OS flaws enabling RCE and root-level attacks
    WatchGuard has disclosed seven critical Fireware OS vulnerabilities affecting Firebox firewalls, several allowing pre-authentication remote code execution.
    • Applies to WatchGuard Firebox firewalls running Fireware OS, plus the Windows Mobile VPN with SSL client; 18 issues fixed in total
    • Seven critical flaws scored 9.1-9.5, including CVE-2026-103594 (9.5, WireGuard stack buffer overflow RCE) and CVE-2026-112709/CVE-2026-112710 (9.2, pre-auth heap overflow RCE in AD authentication service)
    • Other critical bugs: CVE-2026-93865 (FireCluster sync daemon missing authentication allows remote root action injection), CVE-2026-93857 (SIP proxy pre-auth RCE), CVE-2026-93866 (Access Portal integer overflow), CVE-2026-103593 (logging service RCE)
    • Additional issues can expose configuration secrets, allow root file modification, hijack MFA sessions, or cause denial of service
    • Affected versions fixed in Fireware 2026.4 or 12.12.4; T15/T35 devices require 12.5.22; SSL VPN client credential issue fixed in 2026.4
    Sources 📄 Source: psirt.watchguard.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

📋 ADVISORIES

  • 📄 Source for CISA Adds Exploited VMware ESX Logging Flaw CVE-2026-41709 to KEV Catalog — cisa.gov

🔓 CVEs & KEV

  • CVE-2026-109516 — guruteam Bot for Telegram on WooCommerce — CVSS 9.8 — Bot for Telegram on WooCommerce through 1.3.0 - Unauthenticated Authentication Byp...

  • CVE-2026-42922 — Frangoteam — CVSS 9.8 — A authorization bypass vulnerability exists in the /nodered functionality of ...

  • CVE-2026-118312 — Google Chrome — CVSS 9.6 — Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a ...

  • CVE-2026-118309 — Google Chrome — CVSS 9.6 — Improper input validation in UI in Google Chrome on on Android prior to 156.0...

  • CVE-2026-118308 — Google Chrome — CVSS 9.6 — Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remot...

  • CVE-2026-118310 — Google Chrome — CVSS 9.6 — Improper input validation in Views in Google Chrome on on Windows prior to 15...

  • CVE-2026-118338 — Google Chrome — CVSS 8.8 — Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a...

  • CVE-2026-118356 — Google Chrome — CVSS 8.8 — Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remot...

  • CVE-2026-118315 — Google Chrome — CVSS 8.8 — Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allo...

  • CVE-2026-118330 — Google Chrome — CVSS 8.8 — Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078....

  • CVE-2026-118341 — Google Chrome — CVSS 8.8 — Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allo...

  • CVE-2026-118347 — Google Chrome — CVSS 8.8 — Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed ...

  • CVE-2026-118314 — Google Chrome — CVSS 8.8 — Improper input validation in UI in Google Chrome on on Android prior to 156.0...

  • CVE-2026-118335 — Google Chrome — CVSS 8.8 — Improper input validation in Metrics in Google Chrome on on Mac prior to 156....

  • CVE-2026-113387 — canva ortto — CVSS 8.6 — The Ortto plugin for WordPress before 1.0.25 did not authenticate configurati...

  • CVE-2026-96228 — sslplugins SSL Wireless SMS Notification — CVSS 8.1 — SSL Wireless SMS Notification through 3.8.1 - Unauthenticated Authentication Bypas...

  • CVE-2026-93757 — wild-apricot Wild Apricot Login — CVSS 7.5 — Wild Apricot Login through 1.0.18 - Authentication Bypass via SSO Email-Collision ...

  • CVE-2026-93904 — dejanmarkovic Social Web Suite – Social Media Auto Post, Social Media Auto Publish — CVSS 7.5 — Social Web Suite through 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts...

  • CVE-2026-93855 — brewlabs SendPress Newsletters — CVSS 7.5 — SendPress Newsletters through 1.26.1.20 - Unauthenticated SQL Injection via 'subsc...

  • CVE-2026-96666 — vberkel Schema App Structured Data — CVSS 7.2 — Schema App Structured Data through 2.3.2 - Unauthenticated Stored Cross-Site Scrip...

  • CVE-2026-96669 — wpscripts Food Store – Online Food Delivery & Pickup — CVSS 7.2 — Food Store through 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'servic...

  • CVE-2026-96741 — mlfactory DSGVO All in one for WP — CVSS 7.2 — DSGVO All in one for WP through 5.0 - Unauthenticated Stored Cross-Site Scripting ...

  • CVE-2026-118905 — nvm-sh nvm — CVSS 7.1 — nvm_ls lets an untrusted version string inject sed commands, executing arbitr...

  • CVE-2026-66090 — Apereo Foundation openEQUELLA — CVSS 7.1 — XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File R...

  • CVE-2026-66091 — Apereo Foundation openEQUELLA — CVSS 6.9 — Unauthenticated IDOR Enables Disclosure of Other Users’ last-known detailsIn ...

  • CVE-2026-93293 — saadiqbal Password Protected – Protect Your Site Content With a Password — CVSS 6.4 — Password Protected through 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site S...

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check