# Warp Panda exploits VMware ESX CVE-2026-41709; PHP2Shell (CVE-2026-109618/109619) chained with Fragnesia (CVE-2026-46300) to root firewalls

> Help Net Security (2026-10-29) reports a China-nexus campaign attributed to Warp Panda that rooted 25 firewalls across the United States, Japan, Taiwan and South Korea using about 40 custom post-exploitation scripts. CISA added the VMware ESX flaw CVE-2026-41709 and the Linux kernel LPE Fragnesia (CVE-2026-46300) to KEV on 2026-10-28, while the PHP2Shell RCE pair (CVE-2026-109618/109619) is being exploited against internet-exposed systems.

- **Published:** 2026-10-29T18:28:41Z
- **Last reviewed:** 2026-10-29T18:28:41Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4761
- **ID:** TL-2026-4761
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** WARP PANDA (China)
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-41709, CVE-2026-46300, CVE-2026-109618, CVE-2026-109619, CVE-2026-76418

## Description

Help Net Security reports on a China-nexus intrusion set tracked as Warp Panda that compromised 25 firewalls in the United States, Japan, Taiwan and South Korea, with three US government-affiliated servers specifically targeted. Operators used roughly 40 custom post-exploitation scripts and implanted webshells running with root privileges. The article names BRICKSTORM and SharpStorm as custom malware, describes initial access through internet-facing edge devices, pivoting into VMware vCenter, theft of Microsoft 365 user session tokens, registration of attacker-controlled MFA devices on compromised accounts, and credential extraction from Active Directory domain controllers. The article also mentions AI-assisted campaign coordination and cites the CrowdStrike 2026 Legal Threat Landscape Report, Dream research, and vendor advisories. The article states no IOCs.

CVE-2026-41709 is a VMware ESX insufficient-logging flaw fixed by Broadcom in VMSA-2026-0006 (published 2026-07-29, updated 2026-08-19). Broadcom scores it CVSS v3 2.7 (Low): it requires a high-privilege administrator and lets that administrator perform certain operations without them being logged, i.e. audit-trail evasion rather than a standalone compromise primitive. Affected: VMware Cloud Foundation ESX 9.1.x and 9.0.x, VMware ESX 8.0, VCF ESX 5.x and Telco Cloud Platform ESX 5.0.x/5.1.x; fixed in ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 and VCF 5.2.4. Although the source headline calls it a zero-day, the vendor advisory describes a low-severity post-privilege logging gap; analysts should treat it as a defense-evasion enabler on hosts where the attacker already holds ESX admin rights. CISA added it to KEV on 2026-10-28 with a federal deadline of 2026-11-11.

CVE-2026-46300 (Fragnesia) is a Linux kernel XFRM ESP-in-TCP local privilege escalation (CVSS v3 7.8). skb_try_coalesce() fails to propagate the SKBFL_SHARED_FRAG flag, so file-cache-backed pages are treated as writable; an unprivileged local user obtains CAP_NET_ADMIN via user and network namespaces and uses a 192-byte XOR via AES-GCM keystream write primitive to modify the page cache of a read-only file. The public PoC (disclosed 2026-05-13 by William Bowling of V12 Security) patches /usr/bin/su in the page cache to obtain root. Dirty Frag patches do not cover it; the esp4/esp6/rxrpc module-blacklist mitigation does. CISA added it to KEV on 2026-10-28 with a deadline of 2026-10-31.

PHP2Shell is a pair of PHP engine RCE flaws fixed on 2026-10-21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (CVSS 4.0 9.2): CVE-2026-109618 (longjmp() out-of-memory handling leaves request memory uninitialized) and CVE-2026-109619 (longjmp() fatal-error handling leaves global state pointing at freed memory, exploitable in a later request). Unit 42 reported about 22.6 million exposed PHP instances; it initially reported post-exploitation at a European government agency but retracted that on 2026-10-23, saying it could not tie initial access to the PHP2Shell CVEs. The Help Net article states ransomware groups are also using PHP2Shell against Palo Alto Networks firewalls whose management interfaces are exposed to the internet, and notes a Cisco ASA/FTD tunnel-group DoS (CVE-2026-76418) confirmed as exploited in October 2026; that Cisco CVE could not be independently corroborated by search and is sourced to the article only.

Background on Warp Panda from CrowdStrike (earlier reporting, summer 2025): a Golang BRICKSTORM backdoor masquerading as vCenter processes (updatemgr, vami-http) with WebSocket-over-TLS C2, DNS-over-HTTPS and nested TLS, fronted by Cloudflare Workers and Heroku; Junction (ESXi implant on port 8090) and GuestConduit (guest-VM VSOCK listener on port 5555); JSP webshells on vCenter, vpxuser SSH use, unauthorized Azure MFA devices, hidden VMs, log clearing and timestomping, 7-Zip for snapshot extraction, and M365 access via stolen session tokens and Microsoft Graph enumeration. These earlier indicators are listed with that provenance and are not stated by the 2026-10-29 article. SharpStorm is named only in the article; no technical description was found.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.004 Unix Shell
- T1505.003 Server Software Component: Web Shell
- T1098.005 Account Manipulation: Device Registration
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1685.006 Clear Linux or Mac System Logs
- T1070.006 Indicator Removal: Timestomp
- T1539 Steal Web Session Cookie
- T1003.003 OS Credential Dumping: NTDS
- T1087.004 Account Discovery: Cloud Account
- T1021.004 Remote Services: SSH
- T1114.002 Email Collection: Remote Email Collection
- T1530 Data from Cloud Storage
- T1560.001 Archive Collected Data: Archive via Utility
- T1071.001 Application Layer Protocol: Web Protocols
- T1572 Protocol Tunneling
- T1090 Proxy

## Sources

- [Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls](https://www.helpnetsecurity.com/2026/10/29/php2shell-fragnesia-vmware-esx-zero-day/)
- [Broadcom VMSA-2026-0006 (CVE-2026-41709)](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017)
- [CrowdStrike: Unveiling WARP PANDA](https://www.crowdstrike.com/en-us/blog/warp-panda-cloud-threats/)
- [Unit 42: CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619.md?facet=app&mode=light)
- [Tenable: Fragnesia (CVE-2026-46300) FAQ](https://tenable.com/blog/fragnesia-cve-2026-46300-faq-about-new-linux-kernel-xfrm-esp-in-tcp-priv-esc)
- [BleepingComputer: New Fragnesia Linux flaw lets attackers gain root privileges](https://www.bleepingcomputer.com/news/security/new-fragnesia-linux-flaw-lets-attackers-gain-root-privileges/)
- [BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws](https://bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws)
- [Help Net Security: PHP2Shell vulnerabilities patched](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/)
- [Recorded Future: PHP2Shell Exploitation](https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation)
- [Tanium: PHP2Shell response](https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4761