A suspected Chinese nation-state actor chained the PHP2Shell exploit with a Linux kernel privilege-escalation vulnerability to gain root access to 25 Palo Alto Network (PAN) firewall and management servers.
The campaign rooted 25 PAN servers across the United States, Japan, Taiwan, and South Korea, according to an investigation by cyber defense platform provider Dream.
There was a particular focus on three specific servers in a US government-affiliated environment, resulting in persistent access to a US government organization's internal Active Directory domain.
The Dream researchers noted a number of indicators of Chinese nation-state involvement in the campaign, including the narrow focus of the targeting.
“Since US, Japan, Taiwan, and South Korea are the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater, this indicates potential nation-state adversary efforts,” they commented.
In addition, a number of tools used in the campaign, such as the large language models (LLMs) DeepSeek and Kimi, and the internet reconnaissance platform FOFA, are Chinese-based services.
The Dream researchers highlighted the “automated and efficient” nature of the exploits, which took place from 23-24 October, including the targeting of specific PAN-OS versions.
“This operation demonstrates a level of preparation and capability that sets it apart from opportunistic exploitation. The attacker invested significant effort into vulnerability research — obtaining PAN-OS firmware, decrypting it, extracting PHP libraries, building precise memory profiles for 9 different software versions, and calibrating exploit geometry through lab testing,” they said.
“There was a clear-cut focus on government targets,” the researchers added.
Palo Alto Networks Confirm Compromise
Palo Alto Networks’ Unit 42 verified Dream’s findings in a blog published on October 29. It said that around .02% of its global installed base has internet-facing management interfaces configured and were impacted by the campaign.
All the affected devices run specific versions of Palo Alto Networks PAN-OS.
“Each of these customers has been individually contacted by our teams. We will continue to investigate and provide any necessary updates as they become available,” Unit 42 wrote.
Palo Alto Networks has recommended that customers review its mitigations for CVE-2026-109618 and CVE-2026-109619 and apply patches immediately.
Chained Exploits Achieves Access in Under 15 Minutes
The attackers developed two separate exploits and chained them together into one request to target the PAN-OS servers. One of these was the widely reported ‘PHP2Shell’ exploit, made up of two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.
The exploit, which affects the PHP server-side programming language used by around 70% of websites, was leaked in October before a scheduled disclosure and release of patches. This resulted in many websites being taken down, including by governments, while emergency fixes were applied.
In the campaign identified by Dream, the threat actors tailored the exploit specifically for PAN-OS, targeting PHP's session.upload_progress mechanism on the PAN-OS management web server.
This was chained to a second exploit, a Linux kernel vulnerability in the XFRM ESP-in-TCP subsystem known as Fragnesia and tracked as CVE-2026-46300. The attackers used this flaw to overwrite authentication rules, allowing root access to be achieved without a password.
“Both exploits run in a single B2 HTTP request. The total chain — from unauthenticated HTTPS connection to persistent root webshell — completes in under 15 minutes,” Dream explained.
Threat Actor Narrows Focus to US Government Servers
Once the exploit was ready, the attacker identified approximately 19,000 internet-facing PAN-OS firewalls worldwide. It narrowed down its targeting through a number of stages, using scanners to identify which devices were connected to the internet, their geographic location and what PAN-OS version they were running. The latter was focused on the PAN-OS 12.1 and 12.2 branches running PHP 8.0.30.
This produced a final target list of 240 firewalls located in the US, Japan, Taiwan and South Korea.
These targets were fed into an automated batch runner that exploited them five at a time, with an 1800-second (30-minute) timeout per target.
Of the 240 targets, 24 firewalls were successfully rooted. For 22 of the 24 rooted firewalls, the attacker only planted a webshell and did not carry out any further post-exploitation activity.
However, the two other firewalls, which belonged a US government-affiliated environment, saw the attackers establish persistent access. This included building an 8-port reverse SSH tunnel, which connected the compromised firewall back to the operator's infrastructure.
The attackers quickly used its access to one of the government servers to compromise a third government server via same PHP2Shell and Fragnesia exploit chain. This brought the total number of servers exploited to 25.
As this third server centrally managed all of the government organization’s firewalls, compromising it gave the attacker access to every managed firewall's configuration, credentials and network settings.
This allowed the threat actor to exploit the server’s connectivity to Active Directory to steal data such as credentials, although the researchers cannot determine the full extent of the accessed data.
“What we cannot determine is whether the password spray, backdoor account creation, or SAML key extraction succeeded. If any of these attacks worked, the compromise extends far beyond the perimeter firewalls into the organization's identity infrastructure,” they warned.
Dream said the campaign demonstrates that finding a vulnerability is only one part of identifying weaknesses across an organization’s systems, particularly with the growing use of chained exploits.
“Defenders need to identify exposed systems, establish what attackers can exploit, and act before a foothold becomes a wider compromise,” the firm added.