China-Linked Actor Chains PHP2Shell and Fragnesia to Root Palo Alto Firewalls

A suspected Chinese state-aligned actor compromised 25 Palo Alto Networks firewall and management servers across the United States, Japan, Taiwan, and South Korea, according to Dream researchers. During October 23–24, the attackers chained PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 with the Fragnesia Linux kernel flaw, CVE-2026-46300, to obtain root access and deploy persistent webshells in under 15 minutes. After initially compromising 24 firewalls, the actor focused on two devices in a US government-affiliated environment and breached a third server that centrally managed the organization's firewalls. That intrusion exposed firewall configurations, credentials, and network settings and enabled access toward Active Directory; researchers could not establish whether subsequent identity attacks succeeded.

Palo Alto Networks' Unit 42 confirmed the findings on October 29, contacted affected customers, and released PAN-OS patches, urging customers to patch immediately and restrict management-interface access. The targeted compromises contrast with broader PHP2Shell activity: researchers reported substantial opportunistic scanning but relatively few confirmed successful intrusions, with appliance-specific exploits still being refined. Reported telemetry identified more than 22.6 million exposed PHP instances as potentially vulnerable, but exposure does not establish successful exploitation. Defiant reported no known successful WordPress compromises despite heavy attack traffic. Organizations operating affected appliances should prioritize remediation and investigate evidence of webshell persistence and exposure of management credentials.