Threat reportVulnerabilityTL-2026-4761
Warp Panda exploits VMware ESX CVE-2026-41709; PHP2Shell (CVE-2026-109618/109619) chained with Fragnesia (CVE-2026-46300) to root firewalls
Warp Panda exploits VMware ESX CVE-2026-41709; PHP2Shell (TL-2026-4761), also tracked as PHP2Shell, is a critical-severity software vulnerability scored CVSS 9.2, first published 2026-10-29. It is attributed to WARP PANDA (China) with medium confidence, affects Broadcom VMware ESX / VMware Cloud Foundation ESX, references 5 CVEs (CVE-2026-41709, CVE-2026-46300, CVE-2026-109618), maps to 18 MITRE ATT&CK techniques (T1003.003, T1021.004, T1036.005), and is covered by 9 detection rules and 15 indicators of compromise.
- CVSS
- 9.2/10Critical
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 18MITRE ATT&CK
- Actors
- 1WARP PANDA
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-4761
- Threat ID
- TL-2026-4761
- Also known as
- PHP2Shell, Fragnesia, BRICKSTORM, SharpStorm
- Severity
- CRITICAL
- CVSS
- 9.2
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- WARP PANDA
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration, legal, technology, manufacturing
- Target regions
- North America, japan, taiwan, south korea
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in Warp Panda exploits VMware ESX CVE-2026-41709; PHP2Shell
Malware and tooling: BRICKSTORM - S9015, GuestConduit, Junction, PHP, SharpStorm, 7-Zip (ESXi-compatible build)
How Warp Panda exploits VMware ESX CVE-2026-41709; PHP2Shell works
Help Net Security (2026-10-29) reports a China-nexus campaign attributed to Warp Panda that rooted 25 firewalls across the United States, Japan, Taiwan and South Korea using about 40 custom post-exploitation scripts. CISA added the VMware ESX flaw CVE-2026-41709 and the Linux kernel LPE Fragnesia (CVE-2026-46300) to KEV on 2026-10-28, while the PHP2Shell RCE pair (CVE-2026-109618/109619) is being exploited against internet-exposed systems.
Help Net Security reports on a China-nexus intrusion set tracked as Warp Panda that compromised 25 firewalls in the United States, Japan, Taiwan and South Korea, with three US government-affiliated servers specifically targeted. Operators used roughly 40 custom post-exploitation scripts and implanted webshells running with root privileges. The article names BRICKSTORM and SharpStorm as custom malware, describes initial access through internet-facing edge devices, pivoting into VMware vCenter, theft of Microsoft 365 user session tokens, registration of attacker-controlled MFA devices on compromised accounts, and credential extraction from Active Directory domain controllers. The article also mentions AI-assisted campaign coordination and cites the CrowdStrike 2026 Legal Threat Landscape Report, Dream research, and vendor advisories. The article states no IOCs.
CVE-2026-41709 is a VMware ESX insufficient-logging flaw fixed by Broadcom in VMSA-2026-0006 (published 2026-07-29, updated 2026-08-19). Broadcom scores it CVSS v3 2.7 (Low): it requires a high-privilege administrator and lets that administrator perform certain operations without them being logged, i.e. audit-trail evasion rather than a standalone compromise primitive. Affected: VMware Cloud Foundation ESX 9.1.x and 9.0.x, VMware ESX 8.0, VCF ESX 5.x and Telco Cloud Platform ESX 5.0.x/5.1.x; fixed in ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 and VCF 5.2.4. Although the source headline calls it a zero-day, the vendor advisory describes a low-severity post-privilege logging gap; analysts should treat it as a defense-evasion enabler on hosts where the attacker already holds ESX admin rights. CISA added it to KEV on 2026-10-28 with a federal deadline of 2026-11-11.
CVE-2026-46300 (Fragnesia) is a Linux kernel XFRM ESP-in-TCP local privilege escalation (CVSS v3 7.8). skb_try_coalesce() fails to propagate the SKBFL_SHARED_FRAG flag, so file-cache-backed pages are treated as writable; an unprivileged local user obtains CAP_NET_ADMIN via user and network namespaces and uses a 192-byte XOR via AES-GCM keystream write primitive to modify the page cache of a read-only file. The public PoC (disclosed 2026-05-13 by William Bowling of V12 Security) patches /usr/bin/su in the page cache to obtain root. Dirty Frag patches do not cover it; the esp4/esp6/rxrpc module-blacklist mitigation does. CISA added it to KEV on 2026-10-28 with a deadline of 2026-10-31.
PHP2Shell is a pair of PHP engine RCE flaws fixed on 2026-10-21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (CVSS 4.0 9.2): CVE-2026-109618 (longjmp() out-of-memory handling leaves request memory uninitialized) and CVE-2026-109619 (longjmp() fatal-error handling leaves global state pointing at freed memory, exploitable in a later request). Unit 42 reported about 22.6 million exposed PHP instances; it initially reported post-exploitation at a European government agency but retracted that on 2026-10-23, saying it could not tie initial access to the PHP2Shell CVEs. The Help Net article states ransomware groups are also using PHP2Shell against Palo Alto Networks firewalls whose management interfaces are exposed to the internet, and notes a Cisco ASA/FTD tunnel-group DoS (CVE-2026-76418) confirmed as exploited in October 2026; that Cisco CVE could not be independently corroborated by search and is sourced to the article only.
Background on Warp Panda from CrowdStrike (earlier reporting, summer 2025): a Golang BRICKSTORM backdoor masquerading as vCenter processes (updatemgr, vami-http) with WebSocket-over-TLS C2, DNS-over-HTTPS and nested TLS, fronted by Cloudflare Workers and Heroku; Junction (ESXi implant on port 8090) and GuestConduit (guest-VM VSOCK listener on port 5555); JSP webshells on vCenter, vpxuser SSH use, unauthorized Azure MFA devices, hidden VMs, log clearing and timestomping, 7-Zip for snapshot extraction, and M365 access via stolen session tokens and Microsoft Graph enumeration. These earlier indicators are listed with that provenance and are not stated by the 2026-10-29 article. SharpStorm is named only in the article; no technical description was found.
MITRE ATT&CK techniques used in TL-2026-4761
Credential Access
T1003.003 OS Credential Dumping: NTDS; T1539 Steal Web Session Cookie
Lateral Movement
T1021.004 Remote Services: SSH
Defense Evasion
T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1070.006 Indicator Removal: Timestomp
Execution
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy; T1572 Protocol Tunneling
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Discovery
T1087.004 Account Discovery: Cloud Account
Persistence
T1098.005 Account Manipulation: Device Registration; T1505.003 Server Software Component: Web Shell
Collection
T1114.002 Email Collection: Remote Email Collection; T1530 Data from Cloud Storage; T1560.001 Archive Collected Data: Archive via Utility
defense-impairment
Affected products and versions in Warp Panda exploits VMware ESX CVE-2026-41709; PHP2Shell
- Broadcom — VMware ESX / VMware Cloud Foundation ESX
Vulnerable versions: ESX 8.0; VCF ESX 9.0.x; VCF ESX 9.1.x; VCF ESX 5.x; Telco Cloud Platform ESX 5.0.x/5.1.x
Fixed in: ESXi-9.1.0.0-25370933; ESXi-9.0.2.0100-25595025; ESXi80U3j-25429389; VCF 5.2.4; KB449886 (Telco Cloud Platform) - Linux kernel — XFRM ESP-in-TCP (Fragnesia)
Vulnerable versions: Kernels released before 2026-05-13 on Ubuntu, RHEL, Debian, openSUSE, CentOS Stream, Gentoo
Fixed in: Kernels containing the 2026-05-13 upstream patch - PHP Group — PHP
Vulnerable versions: PHP 8.5 before 8.5.12; 8.4 before 8.4.27; 8.3 before 8.3.36; 8.2 before 8.2.35
Fixed in: 8.5.12; 8.4.27; 8.3.36; 8.2.35 - Cisco — ASA / FTD (CVE-2026-76418, per article)
Vulnerable versions: Not specified in source
Fixed in: Upgrade to fixed release per Cisco PSIRT
Remediation for Warp Panda exploits VMware ESX CVE-2026-41709; PHP2Shell
Patches
- Broadcom VMSA-2026-0006: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389, VCF 5.2.4
- PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
- Distribution kernel updates containing the 2026-05-13 Fragnesia fix
- Cisco ASA/FTD software upgrade for CVE-2026-76418 (per source article)
Immediate actions
- Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (PHP2Shell) and restrict internet exposure of firewall and PHP management interfaces
- Apply Linux kernel patches for Fragnesia (CVE-2026-46300) by the CISA KEV deadline of 2026-10-31; where unpatched, unload/blacklist esp4, esp6 and rxrpc modules
- Apply Broadcom VMSA-2026-0006 fixes for CVE-2026-41709 (CISA KEV deadline 2026-11-11)
- Revoke Microsoft 365 session tokens and audit/remove unrecognized MFA devices on accounts reachable from compromised hosts
- Hunt for webshells and unexpected root-owned processes on firewalls and edge devices
Workarounds
- rmmod esp4 esp6 rxrpc and set install esp4/esp6/rxrpc /bin/false in /etc/modprobe.d/ (Fragnesia and Dirty Frag)
- Palo Alto Networks Threat Prevention signature 543004 as virtual patching for PHP2Shell
Longer-term hardening
- Remove management interfaces of edge devices from the internet
- Forward ESX, vCenter and firewall logs to an off-host SIEM so that on-host logging gaps cannot hide admin activity
- Restrict user namespaces where not required
- Monitor Microsoft Graph and Entra ID for MFA registration and token anomalies
- Segment vCenter/ESX management networks and rotate Active Directory credentials after compromise
CVEs associated with Warp Panda exploits VMware ESX CVE-2026-41709; PHP2Shell
CVE-2026-41709, CVE-2026-46300, CVE-2026-109618, CVE-2026-109619, CVE-2026-76418
Timeline of Warp Panda exploits VMware ESX CVE-2026-41709; PHP2Shell
- William Bowling of V12 Security publicly discloses Fragnesia (CVE-2026-46300) with a PoC and upstream kernel patch.
- Broadcom publishes VMSA-2026-0006 with fixes for CVE-2026-41709 (ESX insufficient logging, CVSS 2.7); advisory updated 2026-08-19.
- Palo Alto Networks Threat ID 543004 virtual patching for PHP2Shell becomes active.
- PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fixing PHP2Shell CVE-2026-109618 and CVE-2026-109619 (CVSS 4.0 9.2); exploitation attempts reported after technical details leaked.
- Unit 42 retracts its earlier claim linking a European government intrusion to PHP2Shell, saying initial access could not be confirmed as associated with the CVEs.
- CISA adds CVE-2026-41709 (deadline 2026-11-11) and CVE-2026-46300 (deadline 2026-10-31) to the KEV catalog.
- Help Net Security reports Warp Panda rooted 25 firewalls in the US, Japan, Taiwan and South Korea with about 40 custom scripts; Cisco confirms active exploitation of ASA/FTD DoS CVE-2026-76418.
Sources cited for Warp Panda exploits VMware ESX CVE-2026-41709; PHP2Shell
- Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls
- Broadcom VMSA-2026-0006 (CVE-2026-41709)
- CrowdStrike: Unveiling WARP PANDA
- Unit 42: CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)
- Tenable: Fragnesia (CVE-2026-46300) FAQ
- BleepingComputer: New Fragnesia Linux flaw lets attackers gain root privileges
- BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws
- Help Net Security: PHP2Shell vulnerabilities patched
- Recorded Future: PHP2Shell Exploitation
- Tanium: PHP2Shell response
Detection coverage for TL-2026-4761
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4761 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.