Suspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell
Original title: Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit
The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.
Dream says a suspected Chinese nation-state actor chained PHP2Shell with a Linux kernel flaw to gain root on Palo Alto Networks firewall and management servers from October 23 to 24. Of about 19,000 internet-facing PAN-OS devices, 240 in the US, Japan, Taiwan, and South Korea were targeted and 24 rooted; a third US government server brought the total to 25. Unit 42 verified the findings and said about 0.02% of the global installed base with exposed management interfaces was affected. Full data theft, including password spray and SAML key extraction, is unconfirmed.
Unconfirmed: Chinese state attribution rests on Dream's indicators; whether password spray, a backdoor account, or SAML key extraction succeeded is unknown.
- PHP2Shell covers CVE-2026-109618 and CVE-2026-109619; Fragnesia is CVE-2026-46300.
- Targets were PAN-OS 12.1 and 12.2 running PHP 8.0.30.
- The full chain reached a persistent root webshell in under 15 minutes.
- Twenty-two rooted firewalls only received a webshell; two US government systems saw further access.
- An 8-port reverse SSH tunnel and a third management server exposed firewall configs and credentials.
Impact: Root on PAN-OS servers and possible Active Directory credential theft
| Product | Affected |
|---|---|
| Palo Alto Networks PAN-OS | 12.1 and 12.2 branches running PHP 8.0.30 |
| Linux kernel XFRM ESP-in-TCP | — |
- 1.Review Palo Alto Networks mitigations for CVE-2026-109618 and CVE-2026-109619 and apply patches immediately.
- 2.Check internet-facing PAN-OS management interfaces on the 12.1 and 12.2 branches.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web ShellT1021.004 SSH
- Vendors
- Palo Alto Networks
- Products
- PAN-OS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
4 min read at infosecurity-magazine.com
Dream found that a suspected Chinese-nexus actor gained root access to Palo Alto Network firewall servers to target government organizations
By James Coker · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.