Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls
ID: 04d8e8d3-ace7-541b-8f15-61edaa59e103
STIX ID: report--04d8e8d3-ace7-541b-8f15-61edaa59e103
Feed Name: Help Net Security
Threat Score
Security researchers report active exploitation by China-nexus actors: Warp Panda used a VMware ESX zero-day (CVE-2026-41709) to suppress audit trails, attackers chained PHP2Shell flaws with the Fragnesia kernel escalation (CVE-2026-46300) to gain root on numerous servers and firewalls and plant webshells and credentials, and a Cisco firewall vulnerability (CVE-2026-76418) is being exploited to crash devices; CISA and vendors have added or advised remediation for the affected CVEs.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.