Chinese Hackers Root 25 Servers via PAN-OS Exploit Chain
Original: Chained PHP2Shell exploit roots 25 servers, including US Government servers
Why This Matters
PAN-OS firewalls sit at network perimeters; a root-level compromise opens identity infrastructure to attackers.
Dream Research uncovered a Chinese-linked campaign that chained PHP2Shell RCE (CVE-2026-109618/619) with a kernel LPE (CVE-2026-46300) to root 25 PAN-OS firewalls across the US, Japan, Taiwan, and South Korea, including US government-affiliated systems.
On October 25, Dream Research identified a complete attack operation targeting exposed Palo Alto Networks PAN-OS management interfaces. The attacker chained two zero-day-class vulnerabilities — a PHP2Shell remote code execution bug (CVE-2026-109618 / CVE-2026-109619) and the Fragnesia kernel privilege escalation (CVE-2026-46300) — into a single unauthenticated HTTP request that delivers root access on vulnerable devices. The exploit chain hit the PAN-OS management web server, which also serves the GlobalProtect portal.
Twenty-five firewalls were compromised across the US, Japan, Taiwan, and South Korea. After gaining root, the attacker focused on three servers in a US government-affiliated environment, extracting credentials and conducting Active Directory enumeration. Dream recovered roughly 40 custom post-exploitation scripts along with target lists and exploitation logs.
Artifacts suggest AI-assisted development: Claude Code was installed on attack infrastructure, an offensive tool called aiscan was configured with Chinese LLMs DeepSeek and Kimi, and FOFA API keys were present. Dream stopped short of calling it a fully autonomous attack, noting code structure and commenting style across the scripts were consistent with AI-assisted — not AI-generated — authorship. Palo Alto Networks' Unit 42 independently verified the tooling, and patched PAN-OS versions are being released across affected branches.