A suspected China-nexus actor chained flaws in PHP2Shell with a privilege escalation bug in the Linux kernel to gain root access to Palo Alto Networks firewalls, according to researchers at Dream and PAN Unit 42. The attacks reached more than two dozen targets, including multiple servers linked to the U.S. government.
The chained critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109169, along with a high-severity flaw in Fragnesia, tracked as CVE-2026-46300. The threat actor, assisted by AI, gained root access to 25 PAN-OS firewall and management servers in the U.S., Japan, Taiwan and South Korea.
After gaining access to the firewalls, the hacker targeted Microsoft Active Directory. Researchers confirmed the attacks led to directory enumeration and credentials theft.
The attacks impacted a cloud environment that researchers confirmed is linked to the U.S. government.
“This is also bolstered by other indicators, including naming conventions and the presence of CAC authentication,” said Kfir Fleischer, vice president of product and cyber research at Dream. “The specific U.S. government organization that the server belonged to is not clearly evident based on the attacker’s logs.”
Palo Alto Networks said only about 0.02% of its global installed base of firewalls were exposed to the internet and potentially impacted by the campaign, according to a spokesperson.
AI-enabled attacks
The campaign appears to have begun on Oct. 8, when attackers assembled an AI-enabled platform, called aiscan, using AI tools DeepSeek and Kimi.
About 19,000 firewalls were scanned by Oct. 23. The hackers used fingerprinting techniques to identify which firewalls were online and the specific product versions in use.
The attackers filtered potential targets to 240, including U.S. government-linked firewalls. The attackers were able to compromise two dozen firewalls, including at least two U.S. government servers, Fleischer said.
PAN said customers should restrict access to trusted IP addresses and apply PAN-OS fixes that address PHP2Shell vulnerabilities.
The Cybersecurity and Infrastructure Security Agency on Wednesday added CVE-2026-46300 to the Known Exploited Vulnerabilities catalog. CISA previously added the PHP vulnerabilities to the KEV catalog on Monday.
The PHP vulnerabilities have raised alarms across the industry this month. The scripting language is used in an estimated 70% of all websites.
The agency declined to comment on the Dream report.
