Suspected Chinese attackers root 25 servers using PHP2Shell and a Linux kernel flaw

The Register, citing Dream researchers, reports that suspected Chinese attackers chained PHP2Shell with the Fragnesia Linux kernel flaw to root 25 servers on October 23–24. After compromising firewalls tied to a US government-affiliated organization, they reached an internal management server, Dream says. Dream warned the attackers likely still had remote access. The Register reports that Palo Alto Networks’ Unit 42 independently verified the attackers’ tooling and confirmed Dream’s reported results.