> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Chinese actor chains PHP2Shell with kernel bug to breach US gov firewalls - URL: https://f4n6.co.uk/security-feed/chinese-actor-chains-php2shell-with-kernel-bug-to-breach-us-gov-firewalls/ - Published: 2026-10-30T00:45:39.000Z - Updated: 2026-10-30T00:45:39.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-109618, CVE-2026-109619, CVE-2026-46300, Chinese threat actor ## 1\. Executive summary A suspected Chinese actor used a custom, non-public implementation of the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2 critical, both in CISA KEV since 2026-10-26, both at 100% EPSS) to execute commands on Palo Alto Networks PAN-OS firewalls, then chained CVE-2026-46300 (CVSS 7.8 high, in CISA KEV since 2026-10-28, EPSS 16%) to escalate to root. Dream reports 24 compromised firewalls, most attacked on 23 and 24 October, with two US government-affiliated devices taken past initial access into internal network tunnelling and Active Directory enumeration; Palo Alto Networks Unit 42 independently verified the tooling. The attribution to a Chinese actor is Dream's, based on Chinese-language tooling and Chinese AI platforms, and is unconfirmed: no MITRE ATT&CK profile exists for the actor named. EMEA financial services exposure is through internet-facing PAN-OS management interfaces and any PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 predecessor running on the estate, including end-of-life branches. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 19 | A compromised perimeter firewall in a US government-affiliated environment led to Active Directory enumeration and likely persistent remote access, and the same exploit chain is being run against internet-facing firewalls globally | If a client's PAN-OS management plane is internet-reachable and shows exploitation artefacts, this is a candidate major ICT-related incident and the reporting clock to the competent authority starts at classification, not at confirmed data loss | | DORA Art. 28 | The intrusion path runs through a third-party firewall product (PAN-OS) whose vendor fix was not yet available at the time of the campaign, with workarounds issued instead | Clients must be able to show they tracked the vendor's interim mitigations and assessed the dependency, not only that they patched once a release shipped | | NIS2 Art. 21(2)(d) | Exploitation depended on a specific PAN-OS version (12.1, 12.2) and an exposed management interface, both supply-chain and configuration properties of the deployed product | Entities in scope must evidence supply-chain security measures covering appliance firmware versions and management-plane exposure, not just server patching | ## 3\. Technical analysis & attack chain The chain Dream recovered runs from an unauthenticated HTTPS request to a persistent root webshell in under 15 minutes. Palo Alto Networks Unit 42 independently verified the attacker's tooling and confirmed Dream's results, so the mechanism below is corroborated by two parties. The attribution and the government-victim framing rest on Dream alone. 1. Target selection. The actor used FOFA, a Chinese internet asset search engine, to enumerate about 19,000 internet-facing firewalls, narrowed that to about 5,000, filtered to hosts in the United States, Japan, Taiwan and South Korea, then filtered again by exploit profile to a working list of 240 firewalls. 2. Initial access. A crafted unauthenticated HTTPS request reached the firewall management interface. The actor's PHP2Shell implementation was custom and version-specific, not a copy of any public exploit, and was built for PAN-OS 12.1 and 12.2, which run PHP 8.0.30 with a high memory limit that the memory-corruption stages depend on. 3. PHP2Shell exploitation, four stages. Crafted multipart POST requests corrupt PHP memory and force a predictable layout. A second request forges the stale session ID length from that corruption, forcing an out-of-bounds read that exposes the base address of libphp.so. The actor then exhausts PHP memory again to force mod\_data=NULL, creating a stale reference. The final stage forges that reference to execute commands as the nobody user. 4. Privilege escalation. Commands as nobody are not enough for control, so the actor chained CVE-2026-46300 (Fragnesia), a local privilege-escalation flaw in the Linux kernel XFRM ESP-in-TCP subsystem, to reach root. The actor confirmed root by running the id command through the installed webshell. 5. Post-exploitation. About 40 custom post-exploitation scripts ran inside victim organisations. On the two government-affiliated devices the actor tunnelled into the internal network, compromised a third server with the same PHP2Shell exploit, and ran an Active Directory campaign that pulled the full user and group listing, account credentials, private keys and network topology including IP addresses. 6. Outcome. Of 24 compromised firewalls, 22 received only a webshell for later access. The first government-affiliated firewall was rooted on 23 October and crashed shortly afterwards, possibly under roughly 900 MB of exploit traffic, and stayed unresponsive across 240 automated checks over two hours. The second was exploited on 24 October and repeatedly targeted. Dream could not establish the full extent of the compromise and assesses the actor likely retains persistent remote access. The two PHP flaws are memory-safety bugs in PHP's handling of request memory during initialisation, error handling and cleanup. CVE-2026-109618 is an out-of-memory condition involving partially initialised request memory, with a use-after-free in the session upload-progress unserialiser and a related worker-memory disclosure. CVE-2026-109619 is stale state in PHP globals that retain references to freed request memory, with a use-after-free in fatal-error backtraces and a separate OPcache type-confusion flaw. Both are classified CWE-416 and CWE-755\. Wiz, with Calif and OpenAI, found and reported them in August 2026 and demonstrated unauthenticated RCE against WordPress, Drupal and Joomla. Fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released 21 October 2026. Exploitation did not begin with this campaign. Amazon recorded the first PHP2Shell exploitation attempt on 17 October, while the flaws were still under embargo, from a commercial anonymisation network against a honeypot. Cloudflare saw thousands of attempts in the 10 hours before public announcement, tens of thousands in the 45 minutes after, hundreds of thousands within two hours, and millions by the time its CEO commented. GreyNoise counted at least six successful exploitations. WatchTowr and CrowdStrike both report that most public proof-of-concept code is crash-only and does not achieve code execution, which is consistent with Dream's finding that a working exploit had to be purpose-built. Confidence caveats. The Chinese attribution is single-sourced to Dream and rests on Chinese-language use, known Chinese tools, and use of DeepSeek, Kimi, FOFA and an installed Claude Code instance. No MITRE ATT&CK profile exists for the actor, so treat the attribution as unconfirmed. The claim that the two devices belonged to a US government-affiliated environment is Dream's and was not confirmed by CISA or the FBI, both of which declined to comment. The 24-firewall count and the 40-script figure are Dream's. Palo Alto Networks has not confirmed attacks against its products in its own advisory, which rates impact 8.7 and says upcoming PAN-OS releases will address the issue; that vendor position predates or does not reflect the Unit 42 verification reported by The Register, and clients should treat the vendor's "no known attacks" statement as superseded. Red Hat scores both PHP flaws 8.1 and disputes easy exploitability, against the 9.2 recorded in NVD; the NVD score is the one used here. ## 4\. Mitigation & containment P1, within 24 hours. - Remove internet reachability from every PAN-OS management interface. The entire chain begins with an unauthenticated HTTPS request to a management plane that should not be exposed. Restrict management access to a dedicated jump host or management VLAN and enforce it at the network layer, not by policy alone. - Inventory PAN-OS versions across the estate. Devices on 12.1 or 12.2 are the confirmed targets and carry the PHP 8.0.30 build the exploit was tailored to. Apply Palo Alto Networks' published workarounds and mitigations now, ahead of the fixed release. - Patch PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 wherever PHP runs, including embedded runtimes in appliances and control panels. cPanel, Plesk and DirectAdmin have shipped patches, including fixed builds for the end-of-life 7.4, 8.0 and 8.1 branches. Ubuntu fixed all supported releases on 21 October; Debian fixed bookworm and trixie. AWS has fixes for Elastic Beanstalk, WorkMail, Amazon Linux and Lightsail. - Hunt for webshells on PAN-OS management planes and on any PHP host. Dream's recovered artefacts include a custom PHP2Shell implementation, version-specific profiles, exploitation logs and post-exploitation scripts; the actor verified root by running id through the webshell, so process ancestry showing a web server worker spawning id, or any shell, is a direct signal. - Check for CVE-2026-46300 exploitation on Linux hosts behind the perimeter. The kernel XFRM ESP-in-TCP subsystem is the affected component; a firewall that shows command execution as nobody followed by root activity indicates the chain completed. P2, within 72 hours. - Treat any firewall that was internet-exposed on PAN-OS 12.1 or 12.2 as potentially compromised and review it for tunnelling, unexpected outbound sessions and internal connections originating from the device itself. Dream observed the actor tunnel from the firewall into the internal network within hours. - Rotate credentials, private keys and any secrets reachable from a suspect firewall. The actor extracted account credentials, private keys and network topology, and pulled a full Active Directory user and group listing. - Review Active Directory for enumeration consistent with a full user and group dump, and for authentication from network segments where the firewall sits. - Replace end-of-life PHP. Talos estimates about half of PHP systems will not be patched, and more than 1 million internet-facing hosts were running end-of-life versions as of 21 October, including roughly 700,000 on PHP 3.x to 7.3 and nearly 400,000 on 7.4, 8.0 or 8.1\. End-of-life devices running PHP should come off the network, not be compensated for indefinitely. P3, within 7 days. - Add WAF and IDS coverage for PHP2Shell. Cisco Talos has published Snort coverage including Community Ruleset rules; Broadcom's Symantec and Carbon Black offerings provide behaviour-based signatures and a file-based detection for the related tooling. - Confirm third-party software makers have assessed their own PHP exposure. Cisco has over 30 products under review and reports none known affected; Fortinet has confirmed two dozen products including FortiOS, FortiManager, FortiAnalyzer and FortiWeb are not impacted and is still investigating others; Sophos took its MyUTM portal offline on 21 October because it ran a vulnerable PHP version. - Where PHP cannot be patched immediately, front it with a WAF rule set that blocks the multipart POST patterns the exploit uses, and monitor for the memory-exhaustion behaviour the chain depends on. ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IP addresses, file paths) are present in the source material. Dream's report describes tooling and behaviour but the public reporting does not reproduce file names, hashes or command lines. Behavioural indicators | behaviour | where to observe | confidence | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- | --------------------------------------------------------------------------------- | | Unauthenticated HTTPS requests to the firewall management interface from external addresses, followed by command execution as the nobody user | PAN-OS management plane logs, web server access logs | High, corroborated by Dream and Unit 42 | | Web server worker process spawning id or a shell, used to verify root | EDR process ancestry on the firewall and PHP hosts | High, Dream recovered logs showing this | | Crafted multipart POST requests causing PHP memory exhaustion and worker crashes | PHP-FPM and mod\_php error logs, web server logs | Medium, mechanism described by Dream and CrowdStrike | | About 40 distinct post-exploitation scripts executing after initial access | EDR script and process telemetry | Medium, single-sourced to Dream | | Outbound tunnelling from the firewall into the internal network, followed by internal SMB or LDAP activity and a full AD user and group enumeration | Firewall session logs, domain controller event logs | Medium, single-sourced to Dream | | Kernel privilege escalation via the XFRM ESP-in-TCP subsystem | Linux kernel logs, EDR on hosts behind the perimeter | Medium, CVE-2026-46300 confirmed in CISA KEV, exploitation pattern single-sourced | ## 6\. Detection The sources give no file artefacts, command-line strings, mutexes or registry keys for the custom tooling, so a string-based YARA rule would have nothing genuine to match. Detection here rests on behaviour and on the PHP2Shell request pattern. ```yaml title: PHP2Shell Exploitation Attempt Against PHP Worker id: 7c1e4f2a-9b3d-4a61-8f0e-2d5c6a1b9e34 status: experimental description: Detects multipart POST request bursts consistent with the PHP2Shell memory-corruption stages, followed by a web worker spawning a shell or id. author: Adverse Trace date: 2026-10-30 references: - https://therecord.media/php2shell-successful-exploitation-reports-emerge - https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456 logsource: category: webserver detection: selection_method: cs-method: 'POST' selection_multipart: cs-content-type|contains: 'multipart/form-data' selection_uri: cs-uri-query|contains: - 'PHP_SESSION_UPLOAD_PROGRESS' timeframe: 5m condition: selection_method and selection_multipart and selection_uri | count() by src_ip > 20 fields: - c_ip - cs-uri-query - cs-user-agent falsepositives: - Legitimate large file uploads using session upload progress level: high ``` ```yaml title: Web Worker Spawning Shell or id After PHP Request id: 3a8d1c07-5e2b-4f9a-b6d4-1c7e8f2a0b55 status: experimental description: Detects a PHP-FPM or mod_php worker process spawning id or a shell, the pattern Dream recovered when the actor verified root through a webshell. author: Adverse Trace date: 2026-10-30 references: - https://therecord.media/php2shell-successful-exploitation-reports-emerge logsource: category: process_creation product: linux detection: selection_parent: ParentImage|endswith: - '/php-fpm' - '/httpd' - '/apache2' selection_child: Image|endswith: - '/id' - '/sh' - '/bash' - '/dash' condition: selection_parent and selection_child falsepositives: - Maintenance scripts invoked from web applications level: high ``` ## CVE assessment 3 referenced CVEs — **3 actively exploited (CISA KEV)**, 2 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | ------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618?ref=f4n6.co.uk) | 9.2 Critical | ⚠ KEV 2026-10-26 | 100% | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts… | | [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619?ref=f4n6.co.uk) | 9.2 Critical | ⚠ KEV 2026-10-26 | 100% | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly… | | [CVE-2026-46300](https://nvd.nist.gov/vuln/detail/CVE-2026-46300?ref=f4n6.co.uk) | 7.8 High | ⚠ KEV 2026-10-28 | 16% | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing… | ## 7\. Sources - Recorded Future News, "Limited reports of PHP bug exploitation emerge", https://therecord.media/php2shell-successful-exploitation-reports-emerge, 2026-10-29. - The Register, "Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers", https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456, 2026-10-29. - SecurityWeek, "PHP2Shell Exploitation Started Days Before Patches", https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/, 2026-10. - Recorded Future Insikt Group, "PHP2Shell Exploitation: Two Critical PHP Flaws Explained", https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation, 2026-10-21. - SecurityWeek, "Tech and Security Companies Respond to PHP2Shell Vulnerabilities", https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/, 2026-10. - The Hacker News, "PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking", https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html, 2026-10. - CrowdStrike, "Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation", https://www.crowdstrike.com/en-us/blog/obstacles-to-weaponizing-php2shell-likely-constrain-exploitation/, 2026-10. ## 8\. Adverse Trace position We assess this as critical for any client with PAN-OS management interfaces reachable from the internet, and high for the wider PHP estate. The severity is set by the verified data: CVE-2026-109618 and CVE-2026-109619 are CVSS 9.2 critical, in CISA KEV since 2026-10-26, at 100% EPSS; CVE-2026-46300 is CVSS 7.8 high, in CISA KEV since 2026-10-28, at 16% EPSS. The chain is corroborated by Dream and by Palo Alto Networks Unit 42, but the Chinese attribution is single-sourced and unconfirmed, and no MITRE ATT&CK profile exists for the actor. The government-victim claim is Dream's alone. We will track PAN-OS fixed releases and reissue this advisory when the vendor ships them, and we will monitor for EMEA financial services sightings of the PHP2Shell request pattern. Clients should confirm management-plane exposure and PAN-OS version inventory to us within 24 hours so we can prioritise the estate. --- [Read the original source →](https://therecord.media/php2shell-successful-exploitation-reports-emerge?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*