Suspected Chinese attackers used custom PHP2Shell exploit to gain root on 25 servers

The attackers combined PHP2Shell with a Linux kernel flaw to gain root access and plant web shells on compromised firewalls.

Dream researchers said suspected Chinese attackers began targeting organizations in the US, Japan, Taiwan and South Korea on October 23. They gained root access to 25 servers, including Palo Alto Networks firewalls connected to US government-affiliated organizations.

This is reported by The Register .

Within hours of compromising a US government-affiliated firewall, they had tunneled into the internal network, compromised a third server using the same PHP2Shell exploit, and launched a full Active Directory attack campaign – all through a chain that started with a single unauthenticated HTTPS request to a management interface that should never have been exposed to the internet, – Dream researchers

Within hours of compromising a US government-affiliated firewall, they had tunneled into the internal network, compromised a third server using the same PHP2Shell exploit, and launched a full Active Directory attack campaign – all through a chain that started with a single unauthenticated HTTPS request to a management interface that should never have been exposed to the internet,

Dream said the first government-affiliated firewall was compromised on October 23 and crashed shortly afterward, possibly after receiving 900 MB of exploit traffic. It remained unresponsive despite 240 automated checks over two hours. The attackers compromised a second firewall on October 24. Dream said the attackers likely still had persistent remote access to the affected organizations’ networks.

The firewalls ran vulnerable versions of Palo Alto Networks’ PAN-OS. Dream said it was working with the vendor on the investigation, and Palo Alto Networks’ Unit 42 researchers independently verified the attackers’ tools and confirmed Dream’s reported findings.

The attackers built a custom exploit chain combining PHP2Shell with Fragnesia, a Linux kernel privilege-escalation flaw. Dream said the PHP2Shell exploit it recovered was not a copy of any known public exploit and appeared to have been developed independently for the targeted firewall platform. Once inside, the attackers ran 40 custom post-exploitation scripts.

PHP2Shell consists of CVE-2026-109618 and CVE-2026-109619. The vulnerabilities became known early the week amid concerns that attackers could use them to disrupt much of the internet. Although hundreds of proof-of-concept repositories appeared on GitHub, the first reports of successful attacks came on Saturday. Both flaws have CVSS scores of 9.2 and can be exploited without authentication to run code on vulnerable PHP servers.

Fragnesia (CVE-2026-46300) is a high-severity local privilege-escalation vulnerability in the Linux kernel’s XFRM ESP-in-TCP subsystem. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on Wednesday. CISA and the FBI declined to .

The four-stage PHP2Shell exploit let the attackers run commands without authentication on vulnerable Palo Alto Networks firewalls. They targeted PAN-OS 12.1 and 12.2, which run PHP 8.0.30 with a high memory limit that enabled the exploit’s memory-corruption stages. Dream said the full chain, from an unauthenticated HTTPS connection to a persistent root web shell, took less than 15 minutes.

The attackers first sent crafted multipart POST requests to corrupt PHP memory and create a predictable memory layout. A second request forged the stale session ID length, triggering an out-of-bounds read that exposed the running process’s libphp.so base address. They then exhausted PHP memory again to force mod_data=NULL, creating a stale reference they could forge to run commands as the nobody user. Finally, they used Fragnesia to gain root access and placed a web shell in a publicly accessible directory on the firewall.

After breaking in, the attackers searched Active Directory and stole credentials and other sensitive information. Root access also gave them the master key needed to decrypt the LDAP service account password, which they hardcoded into subsequent scripts. They queried LDAP to list every user and group in the domain and tried password spraying against every user account.

The attackers also tried to create backdoor Active Directory accounts and extract SAML signing keys, but Dream could not determine whether either attempt succeeded. The results were stored on the management server’s local filesystem and were not among the artifacts the researchers recovered.

Dream found Anthropic’s Claude Code installed, along with aiscan, an AI-powered offensive security platform configured with the Chinese models DeepSeek and Kimi. The researchers also found API keys for FOFA, a Chinese internet-asset engine similar to Shodan. The attackers used FOFA to identify 19,000 internet-facing Palo Alto Networks firewalls worldwide. Dream said the activity showed the use of AI tools but was not a fully autonomous attack.

The persistent tunnel into the US government organization is likely still running. And the attacker still has 19,000 fingerprinted targets they can revisit as they develop profiles for additional PAN-OS versions. – Dream researchers

The persistent tunnel into the US government organization is likely still running. And the attacker still has 19,000 fingerprinted targets they can revisit as they develop profiles for additional PAN-OS versions.

You might be interested in:

Palo Alto Networks exceeded fourth-quarter revenue and earnings expectations while acquiring AI platform Console and raising its 2027 financial year forecast.

A Pentagon personnel system breach exposed unencrypted personal records of 2.8 million living people and nearly 300,000 deceased, including Social Security numbers and military service details.