Suspected Chinese Attackers Root 25 Servers via Custom PHP2Shell Exploit
Attackers chained PHP2Shell and Fragnesia to compromise government-affiliated firewalls in under fifteen minutes.
1Targeted Firewall Compromise
Suspected Chinese attackers successfully compromised 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations. The campaign began on October 23, 2026, targeting infrastructure across the US, Japan, Taiwan, and South Korea. Researchers confirmed the attackers gained persistent remote access by exploiting vulnerabilities within the PAN-OS management interface.
2Custom Exploit Chain Mechanics
The attackers utilized a custom four-stage PHP2Shell exploit, specifically tailored for PAN-OS 12.1 and 12.2. They combined this with Fragnesia, a high-severity Linux kernel privilege-escalation flaw affecting the XFRM ESP-in-TCP subsystem. This sophisticated chain allowed them to move from an unauthenticated HTTPS connection to full root access in under fifteen minutes.
3Memory Corruption Strategy
The exploit sequence involves flooding servers with crafted multipart POST requests to corrupt PHP memory and force a predictable layout. By forging stale session IDs, the attackers perform out-of-bounds reads to expose the libphp.so base address. This process enables them to execute commands as the nobody user before escalating privileges to root.
4Active Directory Espionage
Once inside the internal network, the attackers launched a full Active Directory attack campaign. They stole credentials, enumerated users and groups via LDAP queries, and attempted to extract SAML signing keys. By obtaining root access, they successfully decrypted the LDAP service account password, which was then hardcoded into their post-exploitation scripts.
5AI-Powered Offensive Tooling
The investigation uncovered evidence of AI integration, including the use of Anthropic's Claude Code and an offensive platform called aiscan. Attackers configured this platform with Chinese models like DeepSeek and Kimi. Additionally, they utilized API keys for FOFA, a Chinese internet asset search engine, to identify 19,000 vulnerable internet-facing firewalls globally.
6Vendor and Agency Response
Palo Alto Networks' Unit 42 researchers independently verified the attacker's tooling and confirmed the results reported by Dream. The US Cybersecurity and Infrastructure Security Agency added the Fragnesia kernel bug to its Known Exploited Vulnerabilities catalog on Wednesday. Both the FBI and CISA declined to provide official comments regarding the ongoing investigation.
7Operational Impact and Persistence
The first targeted US government-affiliated firewall crashed shortly after the initial compromise, likely due to 900 MB of exploit traffic. Despite the crash, the attackers successfully exploited a second firewall the following day. Researchers warn that the persistent tunnel into the US government organization remains active, posing a significant ongoing security threat.
8Future Threat Landscape
With 19,000 fingerprinted targets identified via FOFA, the attackers possess a vast surface for future operations. They continue to develop profiles for additional PAN-OS versions to expand their reach. Organizations must remain vigilant, as the attackers likely maintain persistent access while refining their techniques for further exploitation of government-affiliated networks.