# Chinese Attackers Use Custom PHP2Shell to Root Palo Alto Firewalls Attackers chained PHP2Shell and Fragnesia exploits to compromise US government-affiliated firewall infrastructure. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-10-29 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/c4a92316-50aa-4808-b84f-d97ee321044a ## Targeted Firewall Infrastructure Compromise Suspected Chinese attackers targeted Palo Alto Networks firewalls running PAN-OS 12.1 and 12.2. The campaign began on October 23, focusing on organizations across the US, Japan, Taiwan, and South Korea. Researchers confirmed that 25 servers were rooted, including critical infrastructure linked to US government-affiliated entities, using highly specialized custom exploit chains. ## Custom PHP2Shell Exploit Mechanism The attackers utilized a custom four-stage PHP2Shell exploit, specifically tailored for the target platform rather than using public repositories. By sending crafted multipart POST requests, they corrupted PHP memory to force predictable layouts. This allowed them to execute commands as the nobody user without any authentication, bypassing standard security protocols within fifteen minutes. ## Privilege Escalation via Fragnesia After gaining initial access, the attackers leveraged Fragnesia, a high-severity Linux kernel vulnerability affecting the XFRM ESP-in-TCP subsystem. This flaw enabled local privilege escalation, allowing the actors to move from the nobody user to full root access. CISA officially added this specific kernel bug to its Known Exploited Vulnerabilities catalog on Wednesday. ## Active Directory Attack Campaign Once root access was established on the firewalls, the attackers tunneled into internal networks to target Active Directory. They successfully decrypted LDAP service account passwords and enumerated domain users and groups. The actors attempted to create backdoor accounts and extract SAML signing keys, demonstrating a sophisticated post-exploitation strategy focused on long-term persistence. ## Integration of AI Offensive Tools The investigation uncovered that the attackers utilized AI-powered offensive security platforms, including Claude Code and aiscan. These tools were configured with Chinese models like DeepSeek and Kimi to assist in the operation. Additionally, the actors used FOFA, a Chinese internet asset search engine, to identify 19,000 potentially vulnerable internet-facing firewalls globally. ## Operational Impact and Persistence Dream researchers warned that the attackers likely maintain persistent, remote access to the compromised organizations. While one firewall crashed due to heavy exploit traffic, the attackers successfully pivoted to a second device within 24 hours. The lack of recovered artifacts regarding successful SAML key extraction leaves the full extent of the data breach uncertain. ## Vendor and Agency Response Palo Alto Networks worked closely with Dream researchers to investigate the compromises, with Unit 42 independently verifying the attacker's tooling. Despite the severity of the CVE-2026-109618 and CVE-2026-109619 vulnerabilities, both the FBI and CISA declined to provide public comments regarding the specific nature of the ongoing threat campaign against these government-affiliated firewall systems. ## Strategic Threat Landscape Analysis This incident highlights the danger of exposing management interfaces directly to the internet. By combining custom memory corruption exploits with kernel-level flaws, attackers can bypass traditional defenses in under fifteen minutes. The existence of 19,000 fingerprinted targets suggests that this campaign is part of a broader, ongoing effort to maintain strategic network access. ## Sources covering this story - https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._