China-Linked Chain Roots 25 PAN Firewalls

Twenty-five Palo Alto Networks firewall and management servers, spread across the United States, Japan, Taiwan and South Korea, ended up with root-level webshell access after an intruder chained two separate exploits into a single browser request. The intrusion, which a single security vendor has now attributed to a suspected Chinese nation-state actor, reached into a US government organization's internal Active Directory domain and, by the researchers' own account, leaves open how far the identity compromise actually went.

The details come from an investigation published by cyber defense platform provider Dream, which was subsequently verified by Palo Alto Networks' Unit 42 in an October 29 blog.

Inside the PHP2Shell chain

The attackers built two exploits and fused them into one request against PAN-OS management servers. The first component is the widely reported 'PHP2Shell' exploit, which is composed of two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. In the PAN-OS campaign, the intruders tailored the exploit for the platform, targeting PHP's session.upload_progress mechanism on the PAN-OS management web server.

That was chained to a second flaw: a Linux kernel vulnerability in the XFRM ESP-in-TCP subsystem known as Fragnesia and tracked as CVE-2026-46300. The attackers used the kernel bug to overwrite authentication rules, which let them reach root without supplying a password.

According to Dream, the two stages collapsed into one enclosure. From there, the whole operation moved quickly:

"Both exploits run in a single B2 HTTP request. The total chain — from unauthenticated HTTPS connection to persistent root webshell — completes in under 15 minutes," Dream explained.

— Dream, cyber defense platform provider

Reconnaissance before a single exploit fired

Dream's researchers emphasized that this was not a spray-and-pray operation. The actor invested in vulnerability research ahead of time, obtaining PAN-OS firmware, decrypting it, extracting PHP libraries, building precise memory profiles for 9 different software versions, and calibrating exploit geometry through lab testing.

When the exploit was ready, the attacker first located approximately 19,000 internet-facing PAN-OS firewalls worldwide. Scanners then narrowed that pool by whether each device was reachable from the internet, its geographic location, and which PAN-OS version it ran. The version filter settled on the PAN-OS 12.1 and 12.2 branches running PHP 8.0.30.

That funnel produced a final target list of 240 firewalls in the US, Japan, Taiwan and South Korea. Those targets were fed into an automated batch runner that exploited them five at a time, with an 1800-second (30-minute) timeout per target. Of the 240, 24 firewalls were successfully rooted.

Two web shells, then a reverse tunnel

For 22 of the 24 rooted firewalls, the attacker planted a webshell and stopped there, carrying out no further post-exploitation activity. The remaining two firewalls, both belonging to a US government-affiliated environment, received persistent access. That included building an 8-port reverse SSH tunnel connecting the compromised firewall back to the operator's infrastructure.

The attackers then used access to one of those government servers to compromise a third government machine through the same PHP2Shell and Fragnesia chain, bringing the total number of servers exploited to 25.

That third server was the pivot that mattered. As the central manager for all of the government organization's firewalls, compromising it opened up every managed firewall's configuration, credentials and network settings. From there, the threat actor exploited the server's connectivity to Active Directory to steal data such as credentials.

What the researchers could not confirm

The full extent of the accessed data remains unknown. Dream's researchers were explicit about the limits of their visibility into the Active Directory stage, and warned about the possible downstream effects:

"What we cannot determine is whether the password spray, backdoor account creation, or SAML key extraction succeeded. If any of these attacks worked, the compromise extends far beyond the perimeter firewalls into the organization's identity infrastructure," they warned.

— Dream, cyber defense platform provider

The case for Chinese state involvement

Dream listed several indicators pointing toward Chinese nation-state involvement. The first was the narrow targeting itself. The researchers noted that the four countries in the target list share a strategic role:

"Since US, Japan, Taiwan, and South Korea are the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater, this indicates potential nation-state adversary efforts," they commented.

— Dream, cyber defense platform provider

Tools used in the campaign also point in the same direction. Among them were the large language models DeepSeek and Kimi, and the internet reconnaissance platform FOFA, all of which are Chinese-based services.

The researchers further described the exploits as "automated and efficient" and singled out the targeting of specific PAN-OS versions. In their assessment:

"This operation demonstrates a level of preparation and capability that sets it apart from opportunistic exploitation. The attacker invested significant effort into vulnerability research — obtaining PAN-OS firmware, decrypting it, extracting PHP libraries, building precise memory profiles for 9 different software versions, and calibrating exploit geometry through lab testing," they said.

— Dream, cyber defense platform provider

They added one more observation about the target selection: "There was a clear-cut focus on government targets."

Palo Alto confirms, and scopes the exposure

Unit 42 verified Dream's findings and put a number on the affected population. According to its blog, around .02% of Palo Alto Networks' global installed base has internet-facing management interfaces configured and was impacted by the campaign. All the affected devices run specific versions of PAN-OS.

Unit 42 stated that every one of those customers had been contacted individually. In its words:

"Each of these customers has been individually contacted by our teams. We will continue to investigate and provide any necessary updates as they become available," Unit 42 wrote.

— Unit 42, Palo Alto Networks

The vendor recommended that customers review its mitigations for CVE-2026-109618 and CVE-2026-109619 and apply patches immediately.

How the flaws reached attackers

The PHP2Shell exploit affects the PHP server-side programming language, which the source states is used by around 70% of websites. It was leaked in October before a scheduled disclosure and the release of patches.

That leak set off a scramble. Many websites were taken down, including by governments, while emergency fixes were applied. In this campaign, the attacker took the leaked exploit and rebuilt it around PAN-OS specifically, rather than deploying it as-is.

The intrusion activity itself took place from 23-24 October, according to Dream.

The numbers behind the operation

• 19,000 — internet-facing PAN-OS firewalls identified worldwide during reconnaissance
• 240 — firewalls on the final target list across the US, Japan, Taiwan and South Korea
• 24 — firewalls successfully rooted in the initial wave
• 25 — total servers exploited after the third government server was reached
• 9 — PAN-OS software versions for which memory profiles were built
• 1800 seconds — per-target timeout in the automated batch runner
• 15 minutes — upper bound on the chain, from unauthenticated connection to persistent root webshell
• .02% — share of Palo Alto's global installed base affected, per Unit 42
• 70% — share of websites using PHP, per the source

The gap between patching and exposure

Dream's conclusion from the campaign focuses less on the individual vulnerabilities than on how an organization's own architecture can turn a perimeter compromise into something larger. The researchers argued that finding a vulnerability is only one part of identifying weaknesses across an organization's systems, a point they tied to the growing use of chained exploits.

The management server is the hinge in this story. It was not the perimeter device that mattered most; it was the box holding the configuration, credentials and network settings for every managed firewall, plus a path into Active Directory. Once that was reached, the attacker no longer needed to exploit firewalls one by one.

Why it matters

The practical implication for defenders is that exposure is not the same as patching. A PAN-OS management interface reachable from the internet, even on a small fraction of an installed base, gave an automated runner enough targets to root two dozen machines in a two-day window. Unit 42's advice — review the mitigations for CVE-2026-109618 and CVE-2026-109619 and apply patches immediately — addresses the vulnerable software, but the campaign's path through a central management server suggests that organizations should also ask which of their own systems, if compromised, would hand over credentials for everything else.

Dream framed the defensive task in similarly direct terms: "Defenders need to identify exposed systems, establish what attackers can exploit, and act before a foothold becomes a wider compromise." The unresolved question in this case — whether the password spray, backdoor account creation or SAML key extraction against Active Directory succeeded — is the one that determines whether this remains a firewall incident or becomes an identity one.