Suspected Chinese actor chains PHP2Shell and Fragnesia to root 25 PAN-OS servers

What happened

Researchers at Dream disclosed what appears to be an AI-assisted campaign by a suspected China-nexus actor that combined the PHP2Shell vulnerabilities with a Linux kernel privilege escalation exploit to root 25 servers, including three systems in a US government-affiliated environment (The Hacker News). The Hacker News did not name the vendor. The Register and Infosecurity Magazine report that the affected devices were Palo Alto Networks firewalls running vulnerable PAN-OS versions, and that Palo Alto Networks’ Unit 42 independently verified Dream’s findings (The Register, Infosecurity Magazine).

The vulnerabilities

• PHP2Shell is a pair of flaws, CVE-2026-109618 and CVE-2026-109619, each with a CVSS score of 9.2, that can lead to unauthenticated remote code execution (The Hacker News).
• Fragnesia is CVE-2026-46300, a Linux kernel local privilege escalation flaw with a CVSS score of 7.8 (The Hacker News). It affects the XFRM ESP-in-TCP subsystem, and CISA added it to the Known Exploited Vulnerabilities catalog on Wednesday (The Register).

The exploit chain

• Dream said the exploit was a custom, non-public build, not a copy of any known public PHP2Shell exploit. It targets PHP’s session.upload_progress mechanism on the firewall’s management web server (The Hacker News).
• The attackers targeted PAN-OS 12.1 and 12.2, which run PHP 8.0.30 with a high memory limit that enables the memory corruption stages (The Register).
• Dream said both exploits run in a single HTTP request, and the whole chain, from an unauthenticated HTTPS connection to a persistent root web shell, completes in under 15 minutes (Infosecurity Magazine).
• The Register describes four stages. They corrupt PHP memory, leak the libphp.so base address through an out-of-bounds read, force a stale reference to run commands as the nobody user, and then use Fragnesia to reach root and plant a web shell in a publicly accessible directory (The Register).

Targeting and timeline

• The attacker used FOFA to find about 19,000 internet-facing firewalls with exposed management interfaces. About 5,000 responded to a version scanner, and filtering by country (US, Japan, Taiwan, South Korea) and by release branch running PHP 8.0.30 left 240 targets (The Hacker News).
• An automated batch runner rooted 24 of those. For 22 of them the attacker only planted a web shell (Infosecurity Magazine).
• The first US government-affiliated system was rooted on October 23, 2026, and crashed shortly afterward. A second was rooted on October 24. The attacker then built a reverse SSH tunnel into the internal network and used it to root a third, an internal firewall management server, bringing the total to 25 (The Hacker News).
• That third server centrally managed all of the organization’s firewalls, so compromising it exposed every managed firewall’s configuration, credentials and network settings (Infosecurity Magazine).

Active Directory activity

• The attacker decrypted the LDAP service account password, enumerated users and groups, sprayed passwords, and tried to create backdoor Active Directory accounts. The Register adds an attempted SAML signing key extraction (The Register).
• Whether any of this succeeded is not confirmed, so the full extent of the compromise is indeterminate (The Hacker News).
• Dream warned that the 22 other rooted firewalls remain parked with active web shells, the tunnel into the US government organization is likely still running, and the attacker still holds 19,000 fingerprinted targets (The Hacker News).

Attribution and AI use

• Dream pointed to the narrow targeting of the US, Japan, Taiwan and South Korea as indicating potential nation-state efforts. Attribution to China is described as suspected, not confirmed (Infosecurity Magazine).
• Investigators found Claude Code installed in the attack infrastructure, FOFA API keys, and the aiscan platform configured with DeepSeek and Kimi models (The Hacker News). The Register notes the attack was not fully autonomous (The Register).

Vendor response

• Unit 42 said around 0.02% of Palo Alto Networks’ global installed base has internet-facing management interfaces configured and was impacted. Each affected customer was individually contacted (Infosecurity Magazine).

Context on exploitability

• Before this disclosure, PHP2Shell had seen only limited exploitation in the wild. One forum member argued that real targets require build-specific offsets from libphp.so (The Hacker News).
• This actor built memory profiles for 9 different software versions after obtaining and decrypting PAN-OS firmware (Infosecurity Magazine).

Am I affected?

You are at highest risk if all of the following apply:

• You operate Palo Alto Networks PAN-OS firewalls, especially the 12.1 and 12.2 branches that run PHP 8.0.30 (The Register).
• The management interface is reachable from the internet (The Hacker News).
• You have not applied the vendor’s patches or mitigations for CVE-2026-109618 and CVE-2026-109619 (Infosecurity Magazine).

Palo Alto Networks said it individually contacted each affected customer. If you were not contacted, that does not prove you are safe, because the attacker held 19,000 fingerprinted targets and may add profiles for other PAN-OS versions (The Hacker News).

The exact list of affected PHP versions for PHP2Shell, the affected Linux kernel versions for Fragnesia, and the fixed PAN-OS versions are not confirmed in the sources. Other PHP servers should still check vendor guidance, since PHP2Shell is a PHP-level flaw.

What to do now

1. Remove internet exposure from every firewall management interface, and allow access only from trusted internal networks. Dream called the interface one that should never have been exposed to the internet (The Register).
2. Review Palo Alto Networks’ mitigations for CVE-2026-109618 and CVE-2026-109619 and apply patches immediately, as the vendor advises (Infosecurity Magazine). Specific fixed versions are not confirmed in the sources, so take them from the vendor advisory.
3. Patch the Linux kernel flaw CVE-2026-46300 (Fragnesia) wherever fixes are available. CISA lists it as exploited (The Register). Fixed kernel versions are not confirmed in the sources.
4. Hunt on exposed devices for compromise. Look for PHP web shells in publicly accessible directories on the firewall, unexpected reverse SSH tunnels from the firewall to outside hosts, and unexplained crashes or very heavy inbound traffic to the management interface (The Hacker News, The Register). Published indicators of compromise are not confirmed in the sources.
5. If a device was exposed and unpatched, treat it as potentially rooted. Contact Palo Alto Networks and involve incident response. Because the attacker had root on firewall management servers, assume that stored credentials and configuration were exposed (Infosecurity Magazine).
6. Assess Active Directory. Rotate the LDAP service account password used by the firewall and review logs for mass LDAP enumeration and password spraying. Check for unexpected new accounts, and consider rotating SAML signing keys, since the attacker tried to create backdoor accounts and extract those keys and success is not confirmed (The Register).
7. Inventory all internet-facing management interfaces across your estate. Dream advised defenders to identify exposed systems, establish what attackers can exploit, and act before a foothold becomes a wider compromise (Infosecurity Magazine).

Sources

• The Hacker News: PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
• The Register: Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers
• Infosecurity Magazine: Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit