Cybersecurity researchers have uncovered a sophisticated attack campaign that combined two critical PHP vulnerabilities with a Linux kernel flaw to gain root access to 24 Palo Alto Networks firewalls. Attackers subsequently breached an internal management server linked to a US government-affiliated organization, bringing the total number of compromised systems to 25.
A newly uncovered cyberattack campaign demonstrates how multiple vulnerabilities can be chained together to bypass security boundaries and compromise critical network infrastructure.
According to an investigation published by Dream Research, attackers combined PHP2Shell (CVE-2026-109618 and CVE-2026-109619) with Fragnesia (CVE-2026-46300), a Linux kernel privilege-escalation vulnerability.
The attack chain allowed the threat actor to execute malicious commands remotely, escalate privileges to root and install PHP webshells on vulnerable Palo Alto Networks firewalls.
On October 29, Palo Alto Networks confirmed the campaign through its Unit 42 threat intelligence team, which independently verified the attacker’s tooling and reported findings.
How PHP2Shell and Fragnesia Work Together
The campaign relied on two distinct attack stages: remote code execution and local privilege escalation.
PHP2Shell: Gaining Initial Access
PHP2Shell refers to two critical vulnerabilities affecting the PHP programming language:
- CVE-2026-109618: A memory corruption vulnerability involving out-of-memory error handling that can enable unauthenticated remote code execution.
- CVE-2026-109619: A vulnerability involving stale memory references and improperly retained global state, potentially allowing attackers to execute arbitrary code remotely.
Both vulnerabilities received a critical CVSS 4.0 score of 9.2.
The PHP development team released security updates on October 21, 2026, fixing the vulnerabilities in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
However, the attacks uncovered by Dream Research targeted the PHP 8.0.30 component embedded in vulnerable PAN-OS installations. Older embedded software can remain exploitable unless the device manufacturer provides the necessary security fixes.
Successful exploitation initially provided command execution under the restricted nobody account.
Fragnesia: Escalating Privileges to Root
The second stage exploited Fragnesia, tracked as CVE-2026-46300.
This Linux kernel vulnerability allows a local attacker to interfere with page-cache-backed data, potentially modifying protected files and escalating privileges.
In the observed campaign, attackers used the vulnerability to alter the system’s PAM authentication configuration, enabling root access without supplying the normal password.
By combining the two techniques, the attackers could move from an unauthenticated HTTPS request to a persistent root-level webshell in less than 15 minutes, according to Dream Research.
From 19,000 Discovered Firewalls to 24 Successful Compromises
The investigation uncovered a carefully organized campaign rather than random attacks against internet-connected devices.
The attackers initially used FOFA, a Chinese internet asset search engine similar to Shodan, to identify approximately 19,000 Palo Alto Networks firewalls with publicly accessible management interfaces.
A custom scanning tool then identified around 5,000 responsive devices and collected software version information.
The attackers narrowed their targets to vulnerable PAN-OS versions in four countries: the United States, Japan, Taiwan and South Korea.
That process produced a final list of 240 firewalls.
An automated exploitation framework attempted to compromise those devices in batches, using customized PHP2Shell and Fragnesia exploits.
The results were significant: 24 of the 240 targeted firewalls were successfully compromised, representing a 10% success rate among the selected targets.
Each successful compromise resulted in root-level access and the installation of a small PHP webshell, allowing attackers to issue commands remotely.
Researchers found no evidence of additional post-exploitation activity on 22 of the compromised firewalls. However, the deployed webshells could potentially allow the attackers to return later.
The remaining two firewalls became the focus of a more targeted operation.
Attackers Infiltrated a US Government-Affiliated Network
Among the compromised firewalls, Dream Research identified two systems associated with the same US government-affiliated organization.
The attackers retrieved configuration information that exposed details about the organization’s internal network, including domain controllers, VPN infrastructure, authentication services and a centralized firewall management server.
One firewall crashed shortly after exploitation on October 23. The attackers subsequently established access through a second firewall on October 24.
Using the compromised device, they created a persistent reverse SSH tunnel into the organization’s internal infrastructure.
This tunnel allowed them to reach an internal firewall management server that was not directly accessible from the public internet.
The attackers then used the same vulnerability chain to compromise that server and obtain root privileges.
This additional intrusion brought the total number of compromised systems to 25: 24 perimeter firewalls and one internal management server.
Active Directory Became the Next Target
Once inside the management infrastructure, the attackers expanded their operation toward Microsoft Active Directory.
The compromised management server already had LDAP connectivity for authentication services, making it a valuable entry point.
Recovered attack artifacts showed that the threat actor:
- Decrypted an LDAP service account password from the management configuration.
- Enumerated Active Directory users and groups.
- Conducted password-spraying attempts against domain accounts.
- Attempted to create unauthorized user and computer accounts.
- Investigated potential privilege-escalation paths and access to single sign-on infrastructure.
Dream Research confirmed credential extraction and directory enumeration. However, researchers could not determine whether the password-spraying attempts, account creation or SAML signing-key extraction were successful.
The full extent of the compromise therefore remains uncertain.
Palo Alto Networks Confirms Active Exploitation
An important development emerged on October 29, when Dream Research updated its findings to identify Palo Alto Networks as the affected firewall manufacturer.
The company’s Unit 42 threat intelligence team confirmed that it had independently verified the attacker’s tools and results.
Palo Alto Networks has also acknowledged active exploitation targeting internet-exposed PAN-OS management interfaces.
Its security advisory identifies affected PAN-OS releases and explains that the vulnerabilities also apply to Panorama management systems.
The vendor emphasizes that the vulnerable surface is the management web interface, including the HTTPS administration interface and XML API.
The GlobalProtect portal, gateway and Clientless VPN are not directly affected by these PHP vulnerabilities.
Palo Alto Networks is distributing security updates across affected PAN-OS branches and recommends immediately restricting management access to trusted internal systems.
CISA Adds the Vulnerabilities to Its Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency (CISA) has also responded to the active exploitation.
On October 26, 2026, CISA added both PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
Two days later, on October 28, the agency added Fragnesia, CVE-2026-46300.
The federal remediation deadlines are particularly urgent:
- October 29, 2026: PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.
- October 31, 2026: Fragnesia vulnerability CVE-2026-46300.
These deadlines apply to covered US federal systems under applicable CISA directives, while private-sector organizations are strongly encouraged to address the same risks without delay.
The addition of all three vulnerabilities to the KEV catalog highlights the real-world danger of combining remote code execution with local privilege escalation.
Is a China-Linked Threat Actor Responsible?
Dream Research identified several indicators suggesting a possible connection to a Chinese-speaking threat actor.
These included the use of FOFA, Chinese-language prompts, infrastructure timestamps aligned with UTC+8 and offensive security tooling configured to use DeepSeek and Kimi AI models.
Researchers also discovered evidence of AI development tools within the attack infrastructure, alongside approximately 40 post-exploitation scripts.
However, the presence of AI tools does not establish that artificial intelligence generated the exploits or independently conducted the attacks.
Similarly, the available evidence does not conclusively establish the attacker’s nationality or prove sponsorship by the Chinese government.
No publicly identified threat group has been definitively linked to the operation.
How Organizations Can Protect Their Firewalls
With exploitation confirmed, organizations using Palo Alto Networks firewalls or other vulnerable PHP-based systems should prioritize immediate remediation.
Recommended security actions include:
- Apply available security patches. Review Palo Alto Networks’ latest PAN-OS advisory and install the appropriate fixed release for each affected system.
- Restrict management interface exposure. Remove direct public internet access and allow administrative connections only through trusted networks or tightly controlled jump hosts.
- Audit previously exposed firewalls. Investigate unexpected PHP files, webshell activity, suspicious reverse SSH connections and unauthorized persistence mechanisms.
- Review credentials and authentication systems. If compromise is suspected, assess exposed LDAP credentials, private keys, management accounts and Active Directory access.
- Update affected PHP and Linux systems. Address PHP2Shell and Fragnesia through supported software releases or verified vendor backports.
Organizations that discover evidence of compromise should begin incident-response procedures rather than assuming that installing a patch alone removes an attacker’s existing access.
A Warning About Exposed Management Interfaces
The PHP2Shell and Fragnesia campaign highlights a serious weakness in enterprise network security: devices intended to protect infrastructure can become entry points when their management services are exposed to the internet.
In this case, a chain of known vulnerabilities enabled attackers to compromise perimeter firewalls, establish persistent access, reach an internal management server and attempt attacks against an organization’s identity infrastructure.
The combination of automated exploitation, targeted reconnaissance and privilege escalation illustrates how quickly a vulnerable network appliance can become a pathway to a much broader compromise.
For administrators, the priority is clear: patch vulnerable systems, isolate management interfaces and investigate any indication that attackers may already have established persistent access.
Sources: Dream Research investigation | Palo Alto Networks security advisory | Unit 42 threat brief | PHP security releases | CISA KEV Catalog