China-nexus actor chains PHP2Shell flaws to compromise PAN firewalls

1. Executive summary

A suspected China-nexus actor chained the PHP2Shell PHP vulnerabilities (CVE-2026-109618, CVSS 9.2, in CISA KEV since 2026-10-26, EPSS 100%) with a Linux kernel privilege-escalation flaw, CVE-2026-46300 (CVSS 7.8, in CISA KEV since 2026-10-28, EPSS 16%), to gain root on 25 Palo Alto Networks PAN-OS firewall and management servers across the US, Japan, Taiwan and South Korea. Dream researchers recovered a custom, non-public exploit chain and roughly 40 post-exploitation scripts; Unit 42 independently verified the tooling. On the two US government-affiliated firewalls the actor went past webshell placement into internal tunnelling, a third-server compromise and an Active Directory attack that produced directory enumeration and credential theft. For EMEA financial services the exposure is internet-facing PAN-OS management interfaces running PHP 8.0.30 (PAN-OS 12.1 and 12.2), where a single unauthenticated HTTPS request to an exposed management plane is the entry point and the full chain to persistent root webshell completes in under 15 minutes. The actor is not in MITRE ATT&CK; attribution to a China-nexus actor is unconfirmed.

2. Regulatory framing

3. Technical analysis & attack chain

The campaign ran from 2026-10-08, when the actor assembled an AI-enabled scanning platform called aiscan using DeepSeek and Kimi, through exploitation on 2026-10-23 and 2026-10-24. Dream recovered the tooling and Unit 42 independently verified it. The chain below is the confirmed sequence for the two US government-affiliated firewalls; for 22 of the 24 firewalls attacked, the actor did nothing beyond planting webshells for later access.

1. Reconnaissance. The actor used FOFA, a Chinese internet asset search engine, to identify about 19,000 internet-facing firewalls, narrowed that to about 5,000, then filtered by geography (US, Japan, Taiwan, South Korea) and by PAN-OS version to a target list of 240.
2. Initial access. A single unauthenticated HTTPS request to an exposed PAN-OS management interface delivered a custom four-stage PHP2Shell exploit. The exploit was not a copy of any public proof of concept; Dream states it was independently developed and tailored to the firewall platform.
3. Code execution as the nobody user. The four stages corrupt PHP memory with crafted multipart POST requests, force a predictable memory layout, forge a stale session ID length to trigger an out-of-bounds read that leaks the base address of libphp.so, then exhaust PHP memory to force mod_data=NULL and create a stale reference used to run commands as nobody.
4. Privilege escalation to root. Fragnesia (CVE-2026-46300), a local privilege-escalation flaw in the Linux kernel XFRM ESP-in-TCP subsystem, took the actor from nobody to root. The recovered logs record root verification by running the id command through the installed webshell.
5. Persistence and internal access. The actor installed a persistent root webshell, then tunnelled into the internal network and compromised a third server using the same PHP2Shell exploit.
6. Active Directory attack. The actor ran an AD campaign that produced directory enumeration and credential theft. Roughly 40 custom post-exploitation scripts were used across targeted organisations.

The total chain, from unauthenticated HTTPS connection to persistent root webshell, completes in under 15 minutes. The first US government-affiliated firewall was rooted on 2026-10-23 and crashed shortly afterwards, possibly under around 900 MB of exploit traffic; it stayed unresponsive across 240 automated checks over two hours. The second was exploited on 2026-10-24. The vulnerable configuration is PAN-OS 12.1 and 12.2, which run PHP 8.0.30 with a high memory limit that the exploit's memory-corruption stages depend on. Palo Alto states about 0.02% of its global installed base was internet-exposed and potentially impacted.

Confidence caveats. The technical detail above rests on the Dream report, corroborated on tooling by Unit 42; the specific post-exploitation script contents, the AD techniques and the tunnelling method are single-sourced to Dream and should be verified before enforcement. Attribution to a China-nexus actor is unconfirmed: the actor has no MITRE ATT&CK profile, and Dream's basis is Chinese-language use, known Chinese tools, Chinese AI models (DeepSeek, Kimi), FOFA, and evidence Claude Code was installed. The US government affiliation of the two servers rests on naming conventions and the presence of CAC authentication, which Dream itself calls indicative rather than conclusive. The CVE pairing in the primary item lists CVE-2026-109169 (SQL injection, CVSS 7.1, not in KEV, EPSS 0%) as part of the chain; The Register and The Record both identify the PHP2Shell pair as CVE-2026-109618 and CVE-2026-109619, so the 109169 reference in the primary item is likely an error and is not treated here as an exploited component. Separately, The Register gives both PHP2Shell bugs a CVSS of 9.2; the verified score for CVE-2026-109618 is 9.2 and no verified score is held for CVE-2026-109619.

4. Mitigation & containment

P1 within 24h

• Remove internet exposure from every PAN-OS management interface. Restrict management access to trusted source IP addresses, as Palo Alto directs, and confirm no management plane is reachable from the public internet. This is the control that breaks the chain at step 2.
• Hunt every PAN-OS 12.1 and 12.2 device for webshells and for the id command having been run through a web-accessible process. Treat any hit as a root compromise, not a web defacement.
• Where PAN-OS fixes for PHP2Shell are available, apply them; where they are not, keep the management plane restricted and monitor it. Palo Alto had not shipped fixed PAN-OS releases at the time of the 2026-10-25 reporting.
• Patch the Linux kernel for CVE-2026-46300 (Fragnesia) on any Linux host in the estate, since it is in CISA KEV and provides the root escalation step.

P2 within 72h

• Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 wherever PHP is deployed outside PAN-OS, covering CVE-2026-109618 and CVE-2026-109619.
• Run the open-source php2shell-scanner from Searchlight Cyber against hosts to test exposure to CVE-2026-109618 and CVE-2026-109619.
• Rotate credentials for any account that authenticated through, or was reachable from, a PAN-OS management interface, and review Active Directory for enumeration and credential-theft activity consistent with the AD campaign.

P3 within 7 days

• Review PAN-OS and Panorama versions against vendor guidance and schedule upgrades off 12.1 and 12.2 where the PHP 8.0.30 memory configuration is the enabling condition.
• Add the detection rules in §6 to EDR and SIEM and tune against the recovered exploit behaviour.

5. Indicators of compromise

No atomic indicators (hashes, domains, IPs, file paths) are present in the source material. The sources describe behaviours only.

6. Detection

The sources give behavioural detail but no distinctive file strings, mutex names, registry keys or command-line artefacts specific to the actor's tooling. The behaviours above are best detected through process and network telemetry on PAN-OS management planes and on AD. No YARA rule is emitted because the sources contain no artefact strings from the malicious files themselves; emitting a rule keyed on CVE identifiers or product names would detect reporting about the threat, not the threat.

title: PAN-OS Management Plane PHP2Shell Exploitation Behaviour
id: 8f3c2a71-6b4d-4e19-9a2c-1d7e5f0b3c84
status: experimental
description: Detects post-exploitation behaviour consistent with the PHP2Shell and Fragnesia chain against PAN-OS management interfaces, including nobody-user command execution, root verification via id, and webshell-driven process activity.
author: Adverse Trace
date: 2026-10-30
references:

  - https://www.cybersecuritydive.com/news/palo-alto-networks-firewalls-compromised-chained-attacks-php2shell/873323/
  - https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456
logsource:
  category: process_creation
  product: linux
detection:
  selection_nobody:
    User|contains: 'nobody'
  selection_id:
    Image|endswith: '/id'
  selection_shell:
    Image|endswith:

      - '/sh'
      - '/bash'
  condition: selection_nobody and (selection_id or selection_shell)
falsepositives:

  - Legitimate service accounts running as nobody that invoke id or a shell during health checks
level: high

CVE assessment

3 referenced CVEs — 2 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• Cybersecurity Dive, "Palo Alto Networks firewalls compromised in chained attacks using PHP2Shell", https://www.cybersecuritydive.com/news/palo-alto-networks-firewalls-compromised-chained-attacks-php2shell/873323/, 2026-10-30
• The Register, "Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers", https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456, 2026-10-29
• The Record (Recorded Future News), "Limited reports of PHP bug exploitation emerge", https://therecord.media/php2shell-successful-exploitation-reports-emerge
• Help Net Security, "Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw", https://www.helpnetsecurity.com/2026/10/25/week-in-review-php-vulnerabilities-patched-exploited-palo-alto-globalprotect-vpn-flaw/, 2026-10-25

8. Adverse Trace position

Adverse Trace assesses CVE-2026-109618 as the priority: CVSS 9.2, in CISA KEV since 2026-10-26, EPSS 100%, and the entry point for a chain that reaches root in under 15 minutes. CVE-2026-46300 (CVSS 7.8, KEV since 2026-10-28, EPSS 16%) is the escalation step and must be patched on Linux hosts independently. CVE-2026-109169 (CVSS 7.1, not in KEV, EPSS 0%) is not part of the exploited chain on the evidence available. Client impact for EMEA financial services turns on one configuration fact: whether a PAN-OS management interface is internet-reachable. Where it is, the exposure is immediate and the actor's persistence means a closed port is not proof of clean. Where it is not, exposure is low. Attribution to a China-nexus actor is unconfirmed and we do not treat it as established. We will track PAN-OS fixed-release availability from Palo Alto and update this advisory when it ships, and we will re-issue if Unit 42 or Dream publish atomic indicators we can pivot on. Clients should confirm management-plane exposure status to us within 24 hours.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.