Suspected Chinese attackers root 25 servers via PHP2Shell and Fragnesia

Palo Alto Networks Unit 42 is aware of two critical PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS 4.0. The bugs, collectively known as PHP2Shell, can be exploited without authentication. Unit 42 says it has observed proof-of-concept code and that at least one European government took a website offline as a precaution. Palo Alto Networks has shipped updates for PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2. The fixes cover PA-Series and VM-Series firewalls, plus Panorama virtual and M-Series deployments. The vendor says no special configuration is required to be affected and that active exploitation has been observed targeting management interfaces exposed to the internet. Administrators should restrict management interface access and apply the fixed PAN-OS release immediately.

Campaign details

Dream researchers reported that suspected Chinese attackers combined a custom PHP2Shell exploit with the Linux kernel flaw CVE-2026-46300, known as Fragnesia, and gained root on 25 servers. Among those were Palo Alto Networks firewalls tied to US government-affiliated organizations. The attacks began on October 23 and hit organizations in the US, Japan, Taiwan, and South Korea. The first US government-affiliated firewall was rooted on October 23 but crashed shortly afterward, possibly due to around 900 MB of exploit traffic; it remained unresponsive through 240 automated checks over two hours. Attackers succeeded against a second firewall on October 24. Dream said the attackers probably retain persistent remote access to compromised networks, and it warned that the tunnel into the US government organization appears to still be running. Unit 42 researchers separately checked the same attacker toolkit and corroborated Dream's findings.

Attack chain and post-exploitation

The custom PHP2Shell exploit was not a copy of any known public proof of concept and appeared to be independently developed and tailored for the targeted firewall platform, Dream researchers wrote. The attackers went after PAN-OS 12.1 and 12.2, versions that run PHP 8.0.30 with a high memory limit, a combination that made the memory-corruption stages possible. The attack first sends crafted multipart POST requests to corrupt PHP memory and create a predictable layout. A second request forges a stale session ID length, causing an out-of-bounds read that reveals the libphp.so base address. The attackers exhaust memory again to run commands as the nobody user, then exploit Fragnesia to gain root and place a web shell in a public directory. The full chain from unauthenticated HTTPS request to persistent root web shell completes in under 15 minutes. After gaining root, the attackers enumerated Active Directory users and groups, stole credentials, decrypted the LDAP service account password, sprayed passwords, and attempted to create backdoor AD accounts and extract SAML signing keys; Dream could not determine whether those later actions succeeded. Evidence showed Anthropic's Claude Code installed, an AI offensive security tool called aiscan set up with Chinese models DeepSeek and Kimi, and FOFA API keys. The attackers used FOFA, a Chinese internet search service, to locate roughly 19,000 internet-facing Palo Alto Networks firewalls worldwide.

Broader exploitation status

SecurityWeek reported that attackers have been hitting PHP2Shell-vulnerable servers for more than a week, though confirmed successes remain few. Unit 42 telemetry identified over 22.6 million exposed PHP instances potentially vulnerable to the two flaws as of October 29. Palo Alto Networks says only about .02 percent of its global installed base had internet-facing management interfaces configured and was impacted, and those customers have been individually contacted. As of October 28, Defiant knew of no WordPress site broken into via PHP2Shell, even though it logged over 77,000 related requests from more than 2,000 IP addresses. Cato Networks found that roughly 96 percent of blocked attacks targeted CVE-2026-109618 and 41 percent attempted remote code execution, with traffic coming from a handful of IPs in the US, Netherlands, and Germany. WatchTowr observed successful exploitation from a single German IP that executed a curl command to prove exploitation and then stopped. The US Cybersecurity and Infrastructure Security Agency added Fragnesia to its Known Exploited Vulnerabilities catalog on Wednesday.

Update, October 30, 2026

CISA has set a remediation deadline of Saturday, Oct. 31, for CVE-2026-46300, the Linux kernel flaw nicknamed Fragnesia. The agency added it to the Known Exploited Vulnerabilities catalog on Wednesday and also added a second flaw, CVE-2026-41709, which involves insufficient logging in Broadcom VMware ESX. KEV inclusion means the agency has evidence the flaws are being actively exploited, according to the source. The order applies to federal civilian executive branch agencies under Binding Operational Directive 26-04, but CISA urges all organizations to patch KEV-listed flaws as a priority. Patched stable kernel branches include the 5.10.257, 5.15.208, 6.1.174, 6.6.141, and 6.12.91 releases, plus 6.18.33, 7.0.10, and 7.1. Administrators should patch PHP and the kernel together, reboot into the new kernel, and, if IPsec is not used, block and unload the esp4 and esp6 modules.