Cyberattack targets firewalls using two vulnerabilities

A cyberattack has exploited two software flaws—PHP2Shell and Fragnesia—to compromise firewalls, potentially allowing unauthorized access to sensitive systems. The attack involved combining a vulnerability that allows arbitrary code execution with another that enables gaining root access on Linux-based systems.

Fragnesia flaw enables root access

Fragnesia (CVE-2026-46300) is a vulnerability in the Linux kernel that allows attackers to escalate their privileges to the highest level, known as root. It arises from a bug in a subsystem that handles IPsec traffic, which incorrectly manages memory fragments, allowing unauthorized modifications to critical system data.

Attackers bypassed security measures

The attackers targeted the configuration file for the PAM authentication module used by the su command, which allows users to switch to another user account. By altering this file, they bypassed authentication checks, allowing them to access systems without needing passwords or user verification.

PHP2Shell used to exploit firewalls

PHP2Shell, another vulnerability, was used to exploit firewalls that use PHP for their administration interface. The attack involved two stages: first, manipulating memory to control future allocations, and second, bypassing a security feature called ASLR to access restricted memory areas.

Attackers identified thousands of firewalls

The attackers used FOFA, a Chinese-based tool similar to Shodan, to identify about 19,000 firewalls with exposed administration interfaces. From these, they narrowed down their targets to 240 firewalls located in the United States, Japan, Taiwan, and South Korea, based on specific criteria.

Attackers targeted U.S.-affiliated systems

Of the 24 firewalls successfully compromised, 22 were left untouched. The other two belonged to an organization affiliated with the American government. The configuration files found on these systems provided clues about their purpose, including references to authentication methods and naming conventions used in U.S. government networks.

Attack infrastructure shows Chinese origin

The attack infrastructure used tools like FOFA, iox, and aiscan, which were configured with Chinese AI models like Kimi and DeepSeek. The clock on the attack servers was set to UTC+8, aligning with Beijing time, and some logs contained messages in Chinese, suggesting the operation originated from China.