# Suspected China-linked attackers gained root access to 25 servers using custom exploits

- URL: https://talkfuse.com/story/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/
- Published: 2026-10-29T19:05:17+00:00
- Updated: 2026-10-29T19:47:30+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456
- Topics: Americas, Government, Politics, World

## Key points

- Attackers rooted 25 servers using a custom exploit chain.
- Targets included firewalls linked to US government-affiliated organisations.
- Researchers say persistent access may remain.

## Summary

Suspected Chinese attackers used a custom exploit chain to gain root access to 25 servers, including Palo Alto Networks firewalls connected to US government-affiliated organisations. The intrusions began on 23 October and affected targets in the US, Japan, Taiwan and South Korea; researchers say the attackers may still have remote access to compromised networks.

Researchers at Dream said the attackers combined the unauthenticated PHP2Shell vulnerabilities with Fragnesia, a Linux kernel privilege-escalation flaw, then ran about 40 custom scripts. One firewall was compromised on 23 October and crashed shortly afterwards; a second was breached the next day. The full chain reportedly took under 15 minutes, and Palo Alto Networks' Unit 42 independently verified the reported findings.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.