# Suspected Chinese Attackers Exploit PHP2Shell to Compromise Government Firewalls Attackers chained custom exploits to gain root access on Palo Alto Networks firewalls. - **Source:** [www.theregister.com - Articles](https://brifing.si/source/2c34ea50-d341-4a10-925d-12c012a9ad10) - **Published:** 2026-10-29 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/e344c34c-6f31-49b7-941a-62b06f4ac66b ## Sophisticated Exploit Chain Deployment Suspected Chinese attackers successfully compromised 25 servers by chaining the PHP2Shell exploit with the Fragnesia Linux kernel vulnerability. This campaign targeted Palo Alto Networks firewalls running vulnerable PAN-OS versions 12.1 and 12.2. The attackers initiated these operations on October 23, specifically focusing on organizations linked to the United States government. ## Rapid Root Access Mechanism The attack sequence completes in under 15 minutes, moving from an unauthenticated HTTPS connection to persistent root access. By flooding servers with crafted multipart POST requests, attackers corrupt PHP memory to force a predictable layout. This allows for out-of-bounds reads, ultimately enabling command execution as a low-privileged user before escalating. ## Fragnesia Privilege Escalation Utility After gaining initial access, the attackers utilized Fragnesia, a high-severity local privilege-escalation flaw affecting the Linux kernel's XFRM ESP-in-TCP subsystem. This tool allowed them to transition from the nobody user to full root access. The US Cybersecurity and Infrastructure Security Agency officially added this specific kernel bug to its known exploited list. ## Active Directory Attack Campaign Once inside the internal network, the attackers launched a full-scale Active Directory campaign. They utilized root access to decrypt LDAP service account passwords and enumerated all domain users and groups. Furthermore, the actors attempted to create backdoor accounts and extract SAML signing keys, though the success of these specific actions remains unconfirmed. ## Integration of AI Reconnaissance Tools The investigation revealed the use of advanced AI tools, including Anthropic's Claude Code and offensive security platform aiscan configured with Chinese models DeepSeek and Kimi. Attackers also utilized the FOFA search engine to identify approximately 19,000 internet-facing Palo Alto Networks firewalls globally, significantly expanding their potential target profile for future exploitation efforts. ## Operational Impact and Persistence The initial compromise of a government-affiliated firewall on October 23 caused a device crash, likely due to 900 MB of exploit traffic. Despite this, the attackers successfully exploited a second firewall the following day. Researchers warn that the attackers likely maintain persistent, remote access to the compromised organizations' internal networks through established tunnels. ## Vendor and Researcher Collaboration Dream researchers identified that the PHP2Shell exploit was not a public copy but a custom-developed tool tailored for the firewall platform. Palo Alto Networks' Unit 42 team independently verified these findings and the attacker's tooling. The vendor has been actively working with researchers to investigate the compromises and mitigate the ongoing security risks. ## Strategic Threat Landscape Implications This incident highlights the danger of exposing management interfaces to the public internet. With 19,000 fingerprinted targets still available, the threat remains significant. Organizations must prioritize patching PAN-OS vulnerabilities and restricting administrative access to prevent similar unauthorized intrusions, as the attackers continue to refine their profiles for additional software versions. ## Sources covering this story - https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._