Cybersecurity researchers have reported that Chinese-based hacking groups are exploiting previously discovered PHP2Shell vulnerabilities to compromise servers and bypass firewalls. The attackers reportedly targeted older operating systems on Palo Alto Networks firewalls, using PHP2Shell in conjunction with Fragnesia, a Linux kernel exploit. This combination allowed them to achieve root access on vulnerable systems.

How the Attacks Unfolded

According to a report by cybersecurity firm Dream, the attacks began on October 23, 2026. The hackers initially scanned companies in the US, Japan, Taiwan, and South Korea. They then focused specifically on Palo Alto Networks devices running older versions of PAN-OS. By chaining the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with the Fragnesia exploit (CVE-2026-46300), attackers managed to infiltrate systems through an internet-exposed management interface. After gaining entry, it was detected that the attackers executed over 40 custom post-exploitation scripts to achieve root access.

Why it matters

PHP2Shell vulnerabilities had raised significant concerns due to PHP's widespread use, powering approximately 70% of the internet. These flaws were believed to enable complete website takeovers. However, mass exploitation attempts did not initially materialize. It was thought that security measures like Address Space Layout Randomization (ASLR) or the difficulty of exploiting the bugs were contributing factors. These recent attacks, however, demonstrate that these barriers can be overcome with the right tools and techniques. The targeting of firewalls, which protect critical infrastructure at the enterprise level, could have severe consequences.

What it means for you

Currently, there is no specific information indicating whether these attacks are directly targeting entities in your region. However, global cyberattacks of this nature can indirectly affect companies in your country. Organizations using Palo Alto Networks firewalls and leaving their management interfaces exposed to the internet must act immediately. Companies should update their firewall operating systems to the latest version and restrict access to their management interfaces. Palo Alto Networks has stated that they have contacted all affected customers individually.

What to Watch Next

It is believed that the attackers may still have active access to the compromised systems. This could lead to further malicious activities such as data exfiltration, ransomware deployment, or deeper network penetration. Cybersecurity experts are warning that such chained attacks may increase. While evidence of artificial intelligence (AI) usage was found, the attack is not thought to have been fully automated by AI. However, AI-powered attacks are likely to become more prevalent in the future.

Frequently Asked Questions

What is PHP2Shell?

PHP2Shell refers to critical vulnerabilities found in the PHP programming language that allow attackers to gain root access to servers. These flaws facilitate the takeover of web applications.

Why were Palo Alto Networks firewalls targeted?

The use of older, unpatched versions of PAN-OS on Palo Alto Networks firewalls made these devices vulnerable to the PHP2Shell and Fragnesia exploits. Attackers exploited these weaknesses through internet-exposed management interfaces.