Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
Original title: Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
Dream says suspected Chinese attackers chained a custom PHP2Shell exploit with the Fragnesia Linux kernel bug to root 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations. Activity began October 23 against targets in the US, Japan, Taiwan, and South Korea. Unit 42 verified the tooling. Dream says persistent access likely remains, while results of Active Directory and SAML attempts were not recovered.
Unconfirmed: Chinese origin is suspected; Dream says access likely remains, and AD and SAML outcomes are unknown.
- PHP2Shell covers CVE-2026-109618 and CVE-2026-109619, both scored CVSS 9.2.
- Fragnesia is CVE-2026-46300; CISA added it to the KEV catalog Wednesday.
- Unauthenticated HTTPS access to a root webshell completed in under 15 minutes.
- Attackers fingerprinted about 19,000 internet-facing Palo Alto firewalls with FOFA.
- Dream does not know if AD backdoors or SAML key theft succeeded.
Impact: Unauthenticated code execution, then root on firewalls
| Product | Affected |
|---|---|
| Palo Alto Networks PAN-OS | 12.1 and 12.2 |
| Linux kernel | — |
- 1.Keep PAN-OS management interfaces off the public internet.
- 2.Hunt compromised firewalls for webshells, tunnels, and reused LDAP credentials.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web ShellT1110.003 Password SprayingT1087.002 Domain Account
- Vendors
- Palo Alto Networks
- Products
- PAN-OSLinux kernel
- AI models
- Claude CodeDeepSeekKimi
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
4 min read at theregister.comSnoops 'likely still' have access to US government-affiliated network
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.