Suspected China-linked attackers gained root access to 25 servers using custom exploits

Suspected Chinese attackers used a custom exploit chain to gain root access to 25 servers, including Palo Alto Networks firewalls connected to US government-affiliated organisations. The intrusions began on 23 October and affected targets in the US, Japan, Taiwan and South Korea; researchers say the attackers may still have remote access to compromised networks.

Researchers at Dream said the attackers combined the unauthenticated PHP2Shell vulnerabilities with Fragnesia, a Linux kernel privilege-escalation flaw, then ran about 40 custom scripts. One firewall was compromised on 23 October and crashed shortly afterwards; a second was breached the next day. The full chain reportedly took under 15 minutes, and Palo Alto Networks' Unit 42 independently verified the reported findings.