Chinese Hackers Exploit VMware ESX Zero-Day and Chain PHP2Shell with Linux Kernel Bug to Root Systems

Cybersecurity researchers report that China-nexus threat actors have exploited a VMware ESX zero-day vulnerability to conceal their activities. Additionally, these attackers chained PHP2Shell flaws with the "Fragnesia" Linux kernel bug (CVE-2026-46300) to achieve root access on servers and firewalls. CISA has added related vulnerabilities to its Known Exploited Vulnerabilities catalog.