PHP2Shell and Fragnesia: root on PAN-OS firewalls in 15 minutes

📌 Later developments: PHP2Shell on PAN-OS: fixes for five branches and Panorama (October 29, 2026)

The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), combined with Fragnesia (CVE-2026-46300), a Linux kernel privilege escalation flaw, were used to gain root on 25 internet-facing systems, mostly firewalls, in the United States, Japan, Taiwan and South Korea. The security company Dream documented the operation and links it to China. On 28 October 2026 CISA added Fragnesia to the KEV catalog, noting that it can be chained with the two PHP CVEs “to implant PHP webshells and run commands as root”.

The PHP CVEs, the fixed versions and the first shells on honeypots are covered in our previous articles, CVE-2026-46300 in the one of 28 October. What is new follows.

What Dream reconstructed

According to The Record, The Register and SecurityWeek, Dream recovered a non-public PHP2Shell implementation written for the firewall platform, version-specific profiles, target lists, exploitation logs and about 40 post-exploitation scripts.

• Using the Chinese search engine FOFA, the attackers identified about 19,000 exposed firewalls, then filtered them by country and exploit profile down to 240 targets.
• The automated attacks took place mainly on 23 and 24 October.
• The numbers differ: SecurityWeek reports 25 breached firewalls and a root webshell on 24, The Record 24 compromised firewalls. On 22 of them the attackers only left the webshell.

Dream did not name the vendor. According to The Register it is PAN-OS, and Palo Alto Networks’ Unit 42 verified the tooling and confirmed the results. Help Net Security reports that on 29 October Palo Alto Networks updated its PHP2Shell advisory: active exploitation has been observed against the management interface exposed to the internet.

The technical chain

According to The Register, the targets were PAN-OS 12.1 and 12.2, which run PHP 8.0.30 with a high memory limit, a condition that makes the memory corruption possible. The steps:

1. a flood of crafted multipart POST requests corrupts memory and makes its layout predictable;
2. a second request forges the length of a stale session ID and, through an out-of-bounds read, leaks the base address of libphp.so;
3. exhausting memory again forces mod_data=NULL and leaves a stale reference;
4. that reference, forged, executes commands as the nobody user.

Then Fragnesia, a logic bug in the XFRM ESP-in-TCP subsystem, in the Dirty Frag class, with a public PoC for the kernels of major distributions released before 13 May 2026 (BleepingComputer), grants root and lets the attackers drop a webshell in a public directory of the firewall; the logs show the check with id (The Record). From the unauthenticated HTTPS connection to the persistent webshell takes under 15 minutes. The exploit is not derived from public ones: it was developed independently.

Aaron Beardslee of Securonix, quoted by CSO Online, notes that Fragnesia writes to the page cache rather than to disk: file integrity checks do not see it and a reboot erases the traces.

Beyond the firewall: internal network and Active Directory

Two firewalls belonged to a US government-affiliated environment. The first, breached on 23 October, crashed shortly afterwards and never came back; the second was breached on the 24th. From there, according to Dream:

• a reverse SSH tunnel opened the internal network, where the same chain compromised the firewall management server, with the configurations and credentials of every managed device;
• with the master key the attackers decrypted the password of the LDAP service account;
• they enumerated domain users and groups, ran password spraying, tried to create backdoor accounts in Active Directory and to extract the SAML signing key.

The outcome of these attempts is unknown, because it stayed on the management server. Dream believes the tunnel is likely still active. The sources publish no indicators of compromise.

Attribution and AI tools

Dream does not name a specific group: it speaks of a China-nexus operation based on language, tools, AI models and the countries chosen. Investigators found Claude Code, an AI-powered offensive platform configured with DeepSeek and Kimi, and FOFA API keys, but it was not a fully autonomous attack. Beardslee calls the attribution “openly contested”. Kevin Beaumont, quoted only by Help Net Security, says he is also aware of a ransomware group using PHP2Shell against Palo Alto firewalls.

MITRE ATT&CK techniques: T1190 (Exploit Public-Facing Application), T1068 (Exploitation for Privilege Escalation), T1505.003 (Web Shell), T1572 (Protocol Tunneling), T1110.003 (Password Spraying), T1136.002 (Create Account: Domain Account).

Impact for European and Italian companies

The known victims are outside Europe, but according to Dream the attackers keep the list of 19,000 firewalls and can return with profiles for other PAN-OS versions. PHP inside an appliance, here an 8.0 branch out of official support, can only be fixed with the vendor’s update: this also applies to other devices running PAN-OS, such as the Siemens RUGGEDCOM APE1808 mentioned on 21 October. For NIS2 entities and healthcare, firewalls and management servers are critical systems, and a compromise must be assessed for notification to CSIRT Italia. According to Cybersecurity360, on 26 October CERT-AGID counted 467 Italian public administration addresses declaring potentially vulnerable PHP versions.

What to do now

1. Management interface: remove it from the internet and follow Palo Alto Networks’ PHP2Shell advisory for PAN-OS updates.
2. Kernel: update for CVE-2026-46300 and reboot; according to Beardslee the fix is not in the Dirty Frag patches. Where nothing terminates IPsec, consider unloading esp4 and esp6, knowing it can break VPNs.
3. PHP: update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or to the vendors’ builds, and restart the workers.
4. Memory first: on a suspect system, capture it before rebooting.
5. Look for traces: new PHP files in web directories, bursts of multipart POST requests to the management interface, firewall crashes, outbound SSH tunnels, new domain accounts.
6. Identity: alert on LDAP binds from hosts that should not hold directory credentials (Beardslee) and change the LDAP service account password and the credentials managed by compromised firewalls.

How ARXDOME helps

ARX Expose shows which of your company’s public services expose recognised products. ARX Sentry collects firewall logs, with dedicated pages showing firmware status; on Linux servers with the agent it lists system, software and processes, and its identity pages show bursts of login attempts and account changes. ARX Shield shows open vulnerabilities per machine, highlighting those already exploited.

Last updated: 30 October 2026