PHP2Shell to execute arbitrary code, Fragnesia to do it with root privileges.
An operation possibly of Chinese origin exploited this tandem to target firewalls. One of them allowed climbing to an Active Directory directory in an environment likely belonging to an organization affiliated with the American government.
The Fragnesia flaw, used to bypass an authentication module
Revealed in May, Fragnesia (CVE-2026-46300) is a local Linux kernel privilege escalation flaw. It stems from a bug in a sub-system that encapsulates IPsec traffic inside TCP streams. In broad terms, the kernel “forgets” that a memory fragment is shared with other system structures and treats it as a writable buffer without raising the usual access protections. One can thus write arbitrary bytes into the page cache and obtain a root shell.
The operation in question targeted the file that configures the PAM authentication module used by the su command. The attacker ensured that the authentication rules pointed to another module, designed to always return a success code without ever requesting or verifying a password. By shifting from user space, the attacker escaped from the sandbox in which SELinux held him – the PHP2Shell exploit had given him a local footprint, but under the identity nobody.
PHP2Shell exploited through upload sessions
The attack targeted a firewall brand whose administration interface uses PHP.
The first step consisted of conditionning the memory to make future object allocations deterministic. Vector: the upload-tracking mechanism, which benefits from initializing a session before any application code executes. The attacker bombarded the server with massive POST requests until memory was saturated. The heap was then in a structured, predictable state.
The second step involved an out-of-bounds read to bypass ASLR.
When Zend – the PHP engine – handles a string such as a session identifier, it relies on a len field to know how many bytes to read or copy. If a session is interrupted, internal structures are only partially cleaned.
The attacker exploited this to send a request containing a session identifier designed to reuse the previous memory location. Because of incomplete error handling when memory is exhausted, the len field retains an artificial value larger than the actual size of the buffer content.
When the server processes the request in question, it must return the session identifier via the Set-Cookie header. As len exceeds the real end of the buffer, the read pointer continues to advance and reads the raw bytes located in the adjacent memory on the heap. The attacker can convert these bytes into an address. Knowing which structure resided there, he offsets relative to the start of libphp.so (determined in advance by reverse-engineering the PHP binary). He can thus calculate the base address of this library and neutralize the ASLR.
A reference offtop for a false hash table
A second memory exhaustion leaves the global http_session_vars active, but empties the internal metadata associated with it. This creates a persistent pointer. The system believes the structure still exists, while the underlying memory has been freed.
A final request, whose data occupies this memory space, fabricates a fake internal hash table.
In Zend, each hash table has a function pointer that cleans up elements when the table is destroyed. The attacker configures it to point directly to the internal C symbol of the native system() function. And points the payload to a shell command. When PHP finishes the request and cleans up its memory, it automatically executes the destructor on the host system, with the privileges of the web server process (nobody).
240 firewalls targeted, 24 rooted
The exploit requires precise memory arrangements that differ between OS versions. In the operation’s traces, 11 profiles were found. Some were “provisional” (offsets calculated by static reverse engineering) and some “calibrated” (validated in the lab).
The global discovery phase relied on FOFA, a Chinese engine similar to Shodan. It identified roughly 19,000 firewalls whose admin interfaces were exposed to the Internet. About 5,000 returned version information. The attacker preserved 240, located in the United States, Japan, Taiwan, and South Korea, and that matched their profiles.
The exploitation was automated in batches of five firewalls, with a timeout of 30 minutes per target. It allowed implanting a webshell in a publicly accessible folder on 24 firewalls.
An Active Directory directory generously consulted
On 22 of these firewalls, the attacker did not carry out any further actions. The other two appeared to be linked to the same organization, thus affiliated with the American government. The first’s configuration file seems to attest to this, notably with the authentication (Common Access Card) and the naming convention of the assets.
This file contained the entire network topology. It convinced the attacker to launch a separate campaign, focused on the other compromised firewall. Having created a persistent SSH tunnel, they climbed to the central firewall management server. Then to the Active Directory, which was connected there (necessary to authenticate VPN users). Having root access, they could decrypt the LDAP service account password. They enumerated users and groups. Then attempted brute force, the domain not limiting password entry attempts.
The results of this attempt remained on the local filesystem of the firewall management server. The success was therefore not certain. The same for actions aimed at creating backdoor accounts (human and machine), to extract the SAML signing key from the Keycloak configuration (weak security: validate-idp-certificate: no) and to analyze ACL chains to detect privilege-escalation paths.
The “nationality” of the targeted firewalls suggests a Chinese-origin operation. As for the tools used (beyond FOFA, there is the tunneling utility iox). Another clue: the offensive security platform aiscan configured with models Kimi and DeepSeek. The attack infrastructure clock was set to UTC+8 (Beijing time). And the logs of aiscan contain user messages in Chinese.
