PHP2Shell Chained With a Linux Kernel Flaw Roots 25 PAN-OS Devices in the US, Japan, Taiwan and South Korea

An attacker chained the PHP2Shell flaws with a Linux kernel bug to take root on Palo Alto Networks firewalls. Dream Research reports that the chain rooted 25 PAN-OS firewall and management servers across the United States, Japan, Taiwan and South Korea, and Palo Alto's Unit 42 says it independently verified the same attacker's tooling and confirmed the reported results. Neither names the victims.

The PHP flaws, CVE-2026-109618 and CVE-2026-109619, were fixed in PHP on 21 October. Both let a single unauthenticated request run code on a PHP server.

How the chain works

PHP2Shell gave the attacker code execution on the firewall's management interface as a low-privilege user. Dream identifies the second step as Fragnesia, CVE-2026-46300 in the kernel's XFRM ESP-in-TCP code, which the attacker used to overwrite the system's PAM rules with pam_permit.so so that su root worked without a password. The whole run, from an unauthenticated HTTPS connection to a persistent root webshell, takes under 15 minutes.

The attacker scanned 19,000 firewalls, rooted 24 and then rooted the 25th machine, an internal management server it reached through a tunnel, with the same chain. Once it had root, it "zeroed in on three specific servers in a US government-affiliated environment". Dream dates the first rooted device to 23 October, two days after the PHP fix shipped.

Dream doesn't name a group. It writes that "multiple indicators point to a Chinese-nexus operation".

How many firewalls are exposed

Unit 42 puts the devices with an affected internet-facing management interface at approximately 0.02% of its global installed base. The advisory says active exploitation has been observed against exposed management interfaces, and the company raised its rating to Critical on 27 October.

The flaws reach PAN-OS on PA-Series and VM-Series firewalls and Panorama through the web UI and XML API.

CISA added Fragnesia to its Known Exploited Vulnerabilities catalogue on 28 October, with a 31 October deadline for US federal agencies.

PHP servers that aren't firewalls

Whether the exploit lands on an ordinary web server depends on how PHP runs there. Tenable got its honeypot exploits working on Apache with mod_php and a single worker, and found that "under FPM, session affinity (PHPSESSID) is required".

PHP's 23 October note lists a related bug, CVE-2026-115560 in session upload progress, unfixed as of that date. The note's mitigation is to set session.upload_progress.enabled=0 in php.ini or the FPM pool, not through ini_set(). Palo Alto says that bug doesn't affect PAN-OS.

What to do

• PAN-OS and Panorama: remove internet access to the management interface now and allow it only from trusted internal addresses, as Unit 42 advises. Then install a fixed release: 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4 or 10.2.18-h13 or later. Older maintenance releases have their own hotfixes in the advisory's table; unsupported versions need an upgrade.
• No fix installed yet: customers with Threat Prevention can enable the Threat IDs listed in the advisory (543004 and others, content 9162 or later).
• A management interface that has been reachable from the internet: check the device for compromise. Dream's report says that after rooting, the attacker tried password spraying, Active Directory backdoor accounts and SAML key theft.
• Linux servers: apply your distribution's kernel update for CVE-2026-46300, the root step in this chain.
• PHP itself: update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and follow the PHP2Shell check-and-patch steps.