China-Linked Group Roots Palo Alto Firewalls in PHP2Shell Attacks

A China-linked hacking group compromised at least 25 Palo Alto Networks firewalls by chaining two PHP2Shell vulnerabilities with the Fragnesia Linux kernel privilege-escalation flaw, according to security researchers and Palo Alto Networks. The attackers gained root access and deployed webshells.

The campaign targeted internet-facing management interfaces on PAN-OS devices. The group exploited CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell vulnerabilities, before using Fragnesia to raise its privileges and maintain access.

Dream identified at least 25 compromised firewalls from a pool of several hundred. Palo Alto Networks’ Unit 42 separately examined the activity and confirmed the attacker tools and the reported attack chain.

“Dream Research has reported a campaign in which attackers chained PHP2Shell with a Linux kernel privilege-escalation vulnerability to gain root access,” Palo Alto Networks said. “Unit 42 has independently verified the same attacker’s tooling and confirmed the reported results.”

Palo Alto Networks released fixes for the PHP2Shell vulnerabilities in PAN-OS versions 12.2, 12.1, 11.2, 11.1 and 10.2. The updates cover PA-Series and VM-Series firewalls and virtual and M-Series Panorama appliances.

The company’s advisory said no special configuration is needed for a device to be vulnerable. It confirmed active exploitation of management interfaces exposed to the internet. Those interfaces are not exposed publicly by default, and the company urged customers to restrict access and install the updates. Palo Alto Networks estimated that about 0.02% of its global installed base had internet-facing management interfaces configured and was affected. It said those customers had been contacted individually.

Palo Alto Networks telemetry identified more than 22.6 million exposed PHP instances that could be vulnerable as of October 29. PHP is used by servers and content management systems, including WordPress, Drupal and Joomla.

Defiant recorded more than 77,000 PHP2Shell-related requests from more than 2,000 IP addresses by October 28. It had not identified a WordPress site successfully compromised through the campaign. Testing found that the exploits often require changes for individual servers because of address-space layout randomization, PHP builds, installed extensions, memory limits and request-handling methods.

Cato Networks found that about 96% of the attacks it blocked targeted CVE-2026-109618, while 41% attempted remote code execution. The remaining activity involved scanning or invalid proof-of-concept requests. The attempts came from a small number of IP addresses in the United States, the Netherlands and Germany, and most often targeted healthcare organizations, followed by technology and security services.

WatchTowr observed one successful PHP2Shell exploitation from a German IP address. In each recorded case, the attacker ran a simple curl command to confirm execution and did not perform additional activity. Researchers said attackers continue to modify their tools and payloads for specific appliances and server environments.