A suspected China-nexus threat actor compromised 25 Palo Alto Networks firewall and management systems by chaining critical PHP remote-code execution flaws with a Linux kernel privilege-escalation vulnerability. The campaign targeted internet-exposed PAN-OS management interfaces across the United States, Japan, Taiwan and South Korea, giving the attacker root-level control of perimeter security devices and, in one confirmed case, a path into an organization’s identity infrastructure.
The initial entry point was PHP2Shell, the name assigned to CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities carry a 9.2 CVSS 4.0 score and can enable unauthenticated remote code execution through memory corruption in PHP. Palo Alto Networks said active exploitation has targeted PAN-OS management interfaces exposed to the internet, although only about 0.02% of its global firewall installed base had that risky configuration and was affected.
Dream Research found that the attacker paired PHP2Shell with CVE-2026-46300, a Linux kernel privilege-escalation flaw known as Fragnesia, to move from code execution under a restricted web-server account to full root access. Researchers said the complete unauthenticated chain could finish in under 15 minutes. The operation began with roughly 19,000 discovered devices, narrowed the list to 240 version-matched targets and initially rooted 24 firewalls before compromising an internal management server as the 25th system.
After breaching firewalls connected to a U.S. government-affiliated environment, the attacker established a persistent reverse tunnel, extracted configuration data and decrypted an LDAP service-account credential. Recovered artifacts confirmed Active Directory user and group enumeration and password-spraying attempts, but researchers could not determine whether attempts to create backdoor accounts or steal SAML signing keys succeeded. The affected government organization was not publicly identified.
The campaign infrastructure contained Claude Code and an offensive platform configured with DeepSeek and Kimi, while about 40 post-exploitation scripts showed patterns consistent with AI-assisted development. However, Dream said it had no direct evidence that the AI tools produced the exploit or scripts, and the activity was not described as a fully autonomous attack. Unit 42 tracks the cluster as CL-UNK-1280 and links it to a Chinese-speaking operator, without assigning it to a named group.
Palo Alto Networks Unit 42 urged customers to install the fixed PAN-OS releases, remove public internet access from management interfaces and restrict administration to trusted internal addresses or a jump host. The company said patched systems are not affected by the observed chain and clarified that GlobalProtect portals, gateways and Clientless VPN are not impacted. Organizations that exposed management services should also hunt for unauthorized web shells, tunnels, configuration access and credential activity rather than treating patching alone as proof that a device was never compromised.
