The 10-Second Story: Attackers have chained two powerful exploits to gain root access on firewalls, compromising 25 servers, including sensitive US government infrastructure, without needing any passwords.
Unlocking the Digital Fortress: A Two-Keyed Heist
Imagine a highly secure vault. This attack is like having two master keys, but instead of picking locks, the attackers used a clever trick involving how a web server (specifically, one running PHP) handles uploaded files.
They found a way to trick the firewall’s web management interface into running their code. But that wasn’t enough to get full control. So, they used a second ‘key’ – a vulnerability in the firewall’s core operating system (the Linux kernel) – to elevate their access from a regular user to the ‘administrator’ (root).
This allowed them to completely take over the firewall, turning it into a gateway for further attacks.
The Anatomy of the Breach: Code, Kernel, and Control
This sophisticated attack leveraged a custom version of the PHP2Shell exploit, targeting a specific weakness in how the firewall’s web server processed file uploads.
This initial compromise allowed the attackers to execute code with limited privileges. To overcome these limitations and achieve full system control, they chained this with the ‘Fragnesia’ exploit, which targets a vulnerability in the Linux kernel’s networking stack.
This kernel exploit allowed them to overwrite a critical system file, effectively granting them passwordless ‘root’ access. The entire process, from the initial connection to gaining root control, was completed in under 15 minutes, all within a single, unauthenticated HTTP request.
- PHP2Shell Exploit (CVE-2026-109618/CVE-2026-109619): Exploits a PHP mechanism (session.upload_progress) on the firewall’s web management server. Requires specific PHP versions (like 8.0.30) and high memory limits to succeed.
- Fragnesia Kernel Exploit (CVE-2026-46300): Targets the XFRM ESP-in-TCP subsystem in the Linux kernel. It overwrites the `/etc/pam.d/su` file to allow any user to become root without a password.
- Targeted Firewalls: Specific versions of a large vendor’s firewall software were affected. The attackers meticulously gathered precise memory offsets for 9 different OS versions, indicating extensive pre-attack research.
- Attack Automation: The attackers used internet scanning tools like FOFA to identify potential targets, then a custom scanner to verify versions. Exploitation was automated, targeting devices in the US, Japan, Taiwan, and South Korea.
From Perimeter Breach to Internal Network Domination
The attackers didn’t just stop at gaining access; they aimed for deeper infiltration. After compromising 25 firewalls, including two belonging to a US government-affiliated organization, they focused their efforts.
In the government environment, they established a persistent tunnel into the internal network. This tunnel allowed them to pivot and exploit a third, internal management server.
From this central point, they launched an attack against the organization’s Active Directory, attempting credential extraction and enumeration.
While the full extent of the Active Directory compromise remains unknown, the ability to tunnel into a government network and launch such attacks highlights a significant security failure.
The AI Shadow: Hints of Automated Assistance
While not a fully autonomous AI attack, evidence suggests the attackers used AI-assisted tooling in their campaign. The consistent code structure, commenting style, and the sheer volume of custom post-exploitation scripts (~40) point towards AI playing a role in development.
This indicates a growing trend where AI tools are being employed to accelerate the creation of sophisticated cyberattack infrastructure, making attacks more efficient and harder to trace.
The Lingering Threat: Unpatched Systems and Future Attacks
This operation underscores the critical importance of patching vulnerable systems. The attackers invested heavily in researching and calibrating their exploits for specific firewall versions.
With 19,000 potential targets identified and 22 firewalls left with active webshells, the threat remains. The attackers can revisit these systems or develop new exploit profiles for other versions.
The US government-affiliated organization’s internal network remains at risk due to the established persistent tunnel. This incident serves as a stark reminder that exposed management interfaces are prime targets and that proactive threat hunting and rapid patching are essential defenses.
Verdict: A Sophisticated, Multi-Stage Attack with Significant Implications
Field Readiness: High. The exploit chain is complex, well-researched, and automated, demonstrating a high level of attacker capability. The targeting of critical infrastructure and government entities is a significant concern.
Source: Originally reported by Techswire Aggregate (rss.app).