“Within hours of compromising a US government-affiliated firewall, they had tunneled into the internal network, compromised a third server using the same PHP2Shell exploit, and launched a full Active Directory attack campaign...” — Dream researchers.
What happened, in short
Suspected Chinese attackers chained a custom PHP2Shell exploit with a Linux-kernel privilege-escalation bug to root 25 servers and to compromise Palo Alto Networks firewalls linked to US government‑affiliated organizations, Dream researchers reported. The campaign began on October 23 and hit organizations across the United States, Japan, Taiwan and South Korea. Dream warned the attackers “likely still” have persistent, remote access to some compromised networks.
Technical chain: PHP2Shell (CVE-2026-109618/109619) plus Fragnesia (CVE-2026-46300)
Dream recovered a four-stage PHP2Shell exploit — built from CVE-2026-109618 and CVE-2026-109619 — that allowed unauthenticated command execution on vulnerable Palo Alto Networks firewalls. The exploit was not a copy of any known public proof-of-concept but “appears to have been independently developed and tailored specifically for the targeted firewall platform.”
The attackers then used the Fragnesia kernel flaw (CVE-2026-46300), which affects the Linux XFRM ESP-in-TCP subsystem, to escalate from the web process user to root and to plant a persistent web shell in a publicly accessible directory. Dream said the full chain — from an unauthenticated HTTPS connection to a persistent root webshell — “completes in under 15 minutes.”
Dream described the four stages in detail: crafted multipart POST requests to corrupt PHP memory and force a predictable layout; a follow-up request that forges a stale session ID length exposing libphp.so base address; further memory exhaustion to forge a stale reference that executes code as the nobody user; and finally Fragnesia to gain root and install the web shell. The attackers ran roughly 40 custom post‑exploitation scripts once inside target networks.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadScope, timeline, and effects on US government‑affiliated firewalls
Dream reported the attackers rooted the first US government‑affiliated firewall on October 23, but that device crashed soon afterward — possibly under around 900 MB of exploit traffic — and remained unresponsive despite 240 automated checks over two hours. A second government‑affiliated firewall was successfully exploited on October 24. After gaining root, the attackers tunneled into internal networks, staged Active Directory enumeration, and executed credential-stealing and password‑spray activity.
With root access the attackers obtained the master key needed to decrypt the LDAP service account password and hardcoded that value into subsequent scripts. Dream said the intruders enumerated every user and group in the domain via LDAP and sprayed passwords against every account. They attempted to create backdoor AD accounts and tried to extract SAML signing keys, but Dream noted it does not know whether those attempts succeeded because the relevant results “were not among the artifacts we recovered.”
Reconnaissance and tooling: FOFA, AI, and fingerprinting 19,000 targets
The attackers used reconnaissance tools and third‑party services to scale their campaign. Dream found FOFA API keys — FOFA is a Chinese internet‑asset search engine — which the actors used to identify about 19,000 internet‑facing Palo Alto Networks firewalls worldwide. The investigation also uncovered evidence of AI tooling: Anthropic's Claude Code, and an offensive platform called aiscan configured with Chinese models DeepSeek and Kimi. Dream emphasised the attack was not fully autonomous, but that the adversary had 19,000 fingerprinted targets to revisit as they profile additional PAN‑OS versions.
Palo Alto Networks, Dream, Unit 42, CISA and the federal response
Dream said it has been working with Palo Alto Networks to investigate the compromises. Palo Alto Networks' Unit 42 researchers independently verified the attackers’ tooling and confirmed Dream's reported results. The US Cybersecurity and Infrastructure Security Agency added the Fragnesia Linux kernel bug to its Known Exploited Vulnerabilities catalog on Wednesday. Both CISA and the FBI declined to comment, according to Dream.
What this means for US government‑affiliated organizations, Palo Alto Networks, and security teams
- US government‑affiliated organizations and their security teams: the incident demonstrates an attacker path that began with “a single unauthenticated HTTPS request to a management interface that should never have been exposed to the internet,” Dream said, and that persistent tunnels into at least one government‑affiliated network are “likely still running.” Teams will be watching for remnants of that tunnel and for signs of the Active Directory actions Dream documented.
- Palo Alto Networks and vendors: Dream and Unit 42 collaboration has already produced vendor verification of the exploit chain; vendors with affected PAN‑OS versions (Dream named 12.1 and 12.2) are now central to understanding impact and remediation for appliances running PHP 8.0.30 with a high memory limit exploited by the chain.
- Security researchers and federal authorities: CISA’s listing of CVE-2026-46300 as a Known Exploited Vulnerability formalizes it for federal attention, while Dream’s finding that FOFA fingerprinting produced 19,000 targets presents a large attack surface to recheck as researchers map which PAN‑OS versions remain at risk.
Dream’s report leaves a clear, specific question: the chain began with a single unauthenticated HTTPS request to a management interface “that should never have been exposed to the internet,” and attackers retain a catalogue of 19,000 fingerprinted firewalls — but Dream could not recover artifacts proving whether password sprays, backdoor account creation, or SAML key extraction succeeded. How many networks still host the persistent tunnels the researchers warned about remains the urgent unknown.
