Warp Panda chains VMware and Linux flaws to root firewalls

1. Executive summary

CrowdStrike reports that a China-nexus group it tracks as Warp Panda used an insufficient-logging flaw in Broadcom VMware ESX, CVE-2026-41709 (CVSS 2.7 LOW, CWE-778, in CISA KEV since 2026-10-28, EPSS 1%), as a zero-day in early 2026 to cut audit-trail visibility during intrusions. Separately, a vendor called Dream reports a China-nexus actor chained the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2 CRITICAL, CWE-416, in CISA KEV since 2026-10-26, EPSS 100%) with the Fragnesia Linux kernel flaw CVE-2026-46300 (CVSS 7.8 HIGH, CWE-787/CWE-456, in CISA KEV since 2026-10-28, EPSS 16%) to root 25 firewalls and pull credentials from Active Directory domain controllers. Cisco has confirmed active exploitation of CVE-2026-76418 (CVSS 8.6 HIGH, CWE-690, not in CISA KEV, EPSS 1%), an unauthenticated denial-of-service in its firewalls' SSL remote access VPN. For EMEA financial services the exposure is concentrated in internet-facing edge devices (firewalls, VPN gateways, hypervisors) that sit in front of identity infrastructure; the two critical PHP2Shell flaws carry an EPSS of 100% and are already in KEV, so the window for pre-exploitation patching has closed.

2. Regulatory framing

3. Technical analysis & attack chain

Two distinct operations are described, plus a third exploited flaw. The Warp Panda reporting rests on a single CrowdStrike report; the PHP2Shell/Fragnesia campaign rests on a single Dream report. Neither actor attribution is corroborated by a second named source in the material reviewed, and Warp Panda has no MITRE ATT&CK profile, so the attribution is unconfirmed.

Confirmed steps in the Warp Panda intrusion, per CrowdStrike:

1. Initial access via internet-facing edge devices.
2. Pivot to VMware vCenter environments.
3. Deployment of custom malware named BRICKSTORM and SharpStorm for persistent access.
4. Exploitation of CVE-2026-41709 on VMware ESX to reduce audit-trail visibility.

CVE-2026-41709 is an insufficient logging vulnerability (CWE-778) in Broadcom's VMware ESX bare-metal hypervisor. Broadcom disclosed and fixed it in July 2026 and credited CrowdStrike researcher Ian Barton. CrowdStrike says the intrusion in which it observed exploitation occurred in early 2026, before the fix. The flaw does not grant code execution; its value to the actor is the removal of evidence. CISA added it to KEV on 2026-10-28 with a US federal remediation deadline of 2026-11-11. CrowdStrike describes Warp Panda as targeting US entities across multiple sectors including legal, and as also compromising Microsoft 365 by stealing user session tokens and occasionally registering a new MFA device on a compromised account.

Confirmed steps in the PHP2Shell/Fragnesia campaign, per Dream and CISA:

1. Exploit the PHP2Shell chain, CVE-2026-109618 and CVE-2026-109619, to implant PHP webshells.
2. Chain CVE-2026-46300 (Fragnesia), a Linux kernel local privilege escalation disclosed in May 2026, to run commands as root.
3. Use the root access to plant webshells and extract credentials from Active Directory domain controllers.

CISA states that CVE-2026-46300 can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. Dream reports the operation rooted 25 servers across the United States, Japan, Taiwan and South Korea, with three specific servers in a US government-affiliated environment targeted after rooting. Dream says it recovered target lists, exploitation logs and approximately 40 custom post-exploitation scripts, and describes the campaign as AI-assisted. Dream did not name the firewall vendor.

The firewall vendor question is unresolved. Palo Alto Networks updated its PHP2Shell advisory on 2026-10-29 to state that active exploitation has been observed against its management interface when exposed to the internet. Security researcher Kevin Beaumont said he is aware of a ransomware group using PHP2Shell against Palo Alto firewalls for initial access, and of reports of a Chinese state group using the same flaws for espionage against the US government. Neither claim is attributed to a named report in the material reviewed, and the ransomware use is a separate actor from the espionage use; the material does not establish that data was encrypted or stolen in that case.

Cisco's CVE-2026-76418 affects its classic and next-generation firewalls. The flaw is a logic error when secondary authentication is configured on a tunnel group. An unauthenticated remote attacker sends a crafted request while connecting to the SSL remote access VPN, causing the device to reload and producing a denial of service. Cisco's PSIRT became aware of active exploitation in October 2026. Cisco states there are no workarounds and recommends upgrading to a fixed release. The flaw is not in CISA KEV.

4. Mitigation & containment

P1 within 24h:

• Patch CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) to the vendor fixed release on every internet-exposed PHP-bearing system. EPSS is 100% and both are in KEV; treat any unpatched instance as likely targeted.
• Patch CVE-2026-46300 (Fragnesia) on Linux hosts running the affected kernel, and on any firewall or appliance whose underlying OS is Linux. CISA's KEV remediation date is 2026-10-31.
• On Palo Alto Networks firewalls, remove internet exposure from the management interface. Palo Alto Networks reports active exploitation against internet-exposed management interfaces; restrict management access to a dedicated management network or jump host.
• On Cisco firewalls, upgrade to a fixed software release for CVE-2026-76418. No workaround exists. Where secondary authentication is configured on a tunnel group, review the configuration and prioritise those devices.
• Patch VMware ESX for CVE-2026-41709 to restore audit logging. Until patched, forward ESX and vCenter logs to an external collector so that tampering with local logs does not erase the record.

P2 within 72h:

• Hunt for PHP webshells on any host that ran an unpatched PHP2Shell-vulnerable component. Dream reports webshell implantation as the post-exploitation step; search web-accessible directories for recently created PHP files and review web server logs for POST requests to unfamiliar .php paths.
• Review Active Directory domain controller authentication logs for credential use from firewall or edge-device IP addresses, following Dream's report of credential extraction from domain controllers.
• Review Microsoft 365 sign-in logs for new MFA device registrations and anomalous session-token use, the pattern CrowdStrike attributes to Warp Panda.
• Confirm vCenter and ESX management interfaces are not reachable from the internet.

P3 within 7 days:

• Inventory all internet-facing edge devices (firewalls, VPN gateways, hypervisors) and map each to its vendor, version and fixed-release status. This is the population both campaigns drew from.
• Where ESX logging was reduced before patching, reconstruct the incident timeline from external log copies and network telemetry; do not rely on the hypervisor's own logs for the early-2026 period.

5. Indicators of compromise

No atomic indicators (hashes, domains, IP addresses, file paths) are present in the source material. The sources describe malware and tooling by name only.

Behavioural indicators:

malware-family  BRICKSTORM
malware-family  SharpStorm

6. Detection

The sources name malware families and describe behaviours but give no file artefacts, command lines, mutexes or paths from which a string-based YARA rule could be built. A YARA rule matching the family names would detect reporting about the threat, not the threat, so none is emitted. The Sigma rule below targets the Cisco firewall reload behaviour, which Cisco has confirmed is being exploited.

title: Cisco Firewall Unexpected Reload via SSL VPN Crafted Request
id: 8f3c2a10-6b7e-4d21-9c55-at20261029
status: experimental
description: Detects unexpected reload of Cisco classic or next-gen firewalls consistent with exploitation of CVE-2026-76418 via the SSL remote access VPN.
author: Adverse Trace
date: 2026-10-29
references:

  - https://www.helpnetsecurity.com/2026/10/29/php2shell-fragnesia-vmware-esx-zero-day/
logsource:
  product: cisco
  service: syslog
detection:
  keywords:

    - "%ASA-2-752001"
    - "Reload requested by"
  vpn_context:

    - "SSL"
    - "WebVPN"
    - "AnyConnect"
  condition: keywords and vpn_context
falsepositives:

  - Administrative reloads
  - Planned maintenance
level: medium

Note: the syslog message identifiers above are placeholders for the Cisco reload event class; confirm the exact message ID against the deployed IOS/ASA version before enabling, since the source does not publish the specific syslog string.

CVE assessment

5 referenced CVEs — 4 actively exploited (CISA KEV), 2 critical (CVSS ≥ 9.0)

7. Sources

• Help Net Security, "Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls", https://www.helpnetsecurity.com/2026/10/29/php2shell-fragnesia-vmware-esx-zero-day/, 2026-10-29.
• CrowdStrike report on Warp Panda, cited within the Help Net Security article above; the primary CrowdStrike report URL is not given in the material reviewed.
• Dream research on the PHP2Shell/Fragnesia campaign, cited within the Help Net Security article above; the primary Dream report URL is not given in the material reviewed.
• Cisco PSIRT advisory on CVE-2026-76418, cited within the Help Net Security article above; the primary Cisco advisory URL is not given in the material reviewed.
• Palo Alto Networks PHP2Shell advisory, updated 2026-10-29, cited within the Help Net Security article above; the primary advisory URL is not given in the material reviewed.

8. Adverse Trace position

Adverse Trace assesses the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) as the highest-priority item here: both are CVSS 9.2 CRITICAL, both are in CISA KEV, and both carry an EPSS of 100%, so exploitation is not hypothetical. CVE-2026-46300 at CVSS 7.8 HIGH with EPSS 16% is the privilege-escalation step that turns webshell access into root. CVE-2026-41709 at CVSS 2.7 LOW is low on its own but is in KEV and matters because it removes the evidence needed to scope an intrusion. CVE-2026-76418 at CVSS 8.6 HIGH is confirmed exploited by Cisco but is a denial of service, not code execution. The Warp Panda attribution is unconfirmed: it rests on a single CrowdStrike report and the actor has no MITRE ATT&CK profile. The Dream campaign attribution is likewise single-sourced. Client impact is highest for firms running internet-exposed Palo Alto Networks management interfaces, unpatched PHP components, or Linux-based firewalls and appliances. We will track the primary CrowdStrike, Dream, Cisco and Palo Alto Networks advisories for atomic indicators and update this note when they are published; clients should treat the behavioural indicators in §5 as the current detection baseline and report any firewall reload or ESX logging gap to us for triage.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.