Under 15 minutes: that was how quickly a chained PHP2Shell and Linux-kernel exploit let attackers gain persistent root access on 25 Palo Alto Networks servers and reach into a US government‑affiliated Active Directory domain, according to cloud detection vendor Dream.
The exploit chain: PHP2Shell (CVE-2026-109618 / CVE-2026-109619) and Fragnesia (CVE-2026-46300)
The intrusion combined two distinct vulnerabilities into a single, automated request. Dream found the campaign used the widely reported “PHP2Shell” exploit — a set of issues tracked as CVE-2026-109618 and CVE-2026-109619 — tailored to PAN‑OS by targeting PHP's session.upload_progress mechanism on the management web server. That was chained to a Linux kernel privilege‑escalation bug in the XFRM ESP‑in‑TCP subsystem, known as Fragnesia and tracked as CVE-2026-46300, which the attacker used to overwrite authentication rules and obtain root without a password.
“Both exploits run in a single B2 HTTP request. The total chain — from unauthenticated HTTPS connection to persistent root webshell — completes in under 15 minutes,” Dream explained.
Scale, selection and tempo: from 19,000 devices to 25 rooted servers
Dream reconstructed the selection and exploitation process. The actor identified roughly 19,000 internet‑facing PAN‑OS firewalls, then scanned for geography and PAN‑OS version — focusing on the 12.1 and 12.2 branches running PHP 8.0.30 — and produced a final list of 240 targets in the United States, Japan, Taiwan and South Korea.
The attacker fed those targets into an automated batch runner that exploited five devices at a time, using an 1,800‑second (30‑minute) timeout per target. Of the 240 devices, 24 firewalls were successfully rooted; for 22 of those the operator only planted a webshell. Two firewalls in a US government‑affiliated environment saw broader post‑exploitation activity, and a third government server was then compromised, bringing the total exploited servers to 25. Dream dates the active exploitation to 23–24 October.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageImpact on a US government‑affiliated environment
Dream highlighted a concentrated focus on three servers inside a US government‑affiliated environment. The attacker established persistent access on two of those servers, including building an eight‑port reverse SSH tunnel linking the compromised firewall back to the operator's infrastructure. Using access on one government server, the actor then compromised a third via the same PHP2Shell+Fragnesia chain.
Because that third server centrally managed the organization’s firewalls, its compromise “gave the attacker access to every managed firewall's configuration, credentials and network settings,” Dream found. That connectivity also provided a path into the organization’s Active Directory and allowed the theft of data such as credentials, although Dream cautioned it “cannot determine the full extent of the accessed data.”
Dream further warned: “What we cannot determine is whether the password spray, backdoor account creation, or SAML key extraction succeeded. If any of these attacks worked, the compromise extends far beyond the perimeter firewalls into the organization's identity infrastructure.”
Indicators suggesting Chinese state‑aligned activity
Dream notes multiple signals that point to a Chinese state‑aligned operator. The campaign’s geographic focus—United States, Japan, Taiwan and South Korea—matches the four countries the researchers described as “the four primary strategic adversaries and intelligence targets for Chinese state‑aligned cyber operations in the Pacific theater.”
The toolchain also included Chinese‑based services, the researchers wrote, such as the large language models DeepSeek and Kimi and the internet reconnaissance platform FOFA. Dream described the operation as “automated and efficient,” and said the attacker invested significant effort into vulnerability research — obtaining PAN‑OS firmware, decrypting it, extracting PHP libraries, building precise memory profiles for nine different software versions, and calibrating exploit geometry through lab testing — signaling a level of preparation that “sets it apart from opportunistic exploitation.”
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: Palo Alto Networks’ Unit 42 verified Dream’s findings and urged customers to review mitigations for CVE-2026-109618 and CVE-2026-109619 and apply patches immediately. Dream added that “defenders need to identify exposed systems, establish what attackers can exploit, and act before a foothold becomes a wider compromise.”
- Policymakers and national‑security officials: the concentrated targeting of government‑affiliated servers and the potential for identity‑infrastructure compromise — including password spray, backdoor account creation, or SAML key extraction — frames this incident as more than a single vendor outage and raises cross‑domain risk where perimeter compromise can feed into identity systems.
- Affected enterprises and procurement leaders: the actor’s success depended on internet‑facing management interfaces and specific PAN‑OS versions; Palo Alto noted only about 0.02% of its global installed base had internet‑facing management interfaces configured and were impacted, underscoring the need to inventory exposed management planes and to prioritize patching of the named CVEs.
Palo Alto Networks said its teams have contacted each affected customer and that it will continue to investigate and provide updates. Dream’s analysis closes with a pointed observation: finding a vulnerability is only part of the problem; by chaining a leaked PHP2Shell exploit with a kernel escalation and applying precise reconnaissance and automation, attackers turned a disclosed weakness into a surgical campaign that reached into an internal Active Directory environment.
