On October 25, 2026, researchers at Dream discovered artifacts of a campaign that chained two zero-day vulnerabilities — a custom PHP2Shell remote code execution exploit and the Fragnesia kernel privilege escalation — to root 25 Palo Alto Networks PAN-OS firewalls in a single HTTP request, without credentials. The affected devices spanned the United States, Japan, Taiwan, and South Korea. Two compromised firewalls belonged to a US government-affiliated environment, where the attacker pivoted from firewall access into the organization's internal Active Directory domain. The exploit chain is technically sophisticated and operationally disciplined. PHP2Shell (CVE-2026-109618/CVE-2026-109619) weaponizes PHP's session.uploadprogress mechanism through four stages: memory exhaustion at ~383MB to force predictable heap layout, an information leak via out-of-bounds read that exfiltrates libphp.so's base address through a Set-Cookie header, a second ~500MB memory pressure round to create a stale zendreference, and finally a forged HashTable entry whose destructor callback points to PHP's system() function. The kernel escalation, Fragnesia (CVE-2026-46300), exploits the XFRM ESP-in-TCP subsystem to overwrite /etc/pam.d/su with pampermit.so via per-byte page-cache splicing, enabling passwordless su root even under SELinux confinement. Both stages execute within a single HTTP request; total time from unauthenticated connection to persistent root webshell: under 15 minutes. The campaign followed a precise funnel. Using FOFA, a Chinese internet asset search engine, the attacker identified approximately 19,000 internet-facing PAN-OS firewalls globally. A custom scanner with 200 concurrent threads fingerprinted versions, yielding 5,000 live responses. Geographic and version filtering — US, Japan, Taiwan, South Korea; PAN-OS 12.1 and 12.2 branches running PHP 8.0.30 — narrowed the list to 240 targets. Automated batch exploitation at five concurrent targets with 30-minute timeouts rooted 24 firewalls, each receiving a 103-byte PHP webshell planted at /unauth/php/changepassword.php. A 25th server ran PAN-OS 11.1 with a provisional PHP 7.4 profile. Of the 24 rooted firewalls, 22 were simply parked — webshell planted, nothing more. The attacker prioritized two firewalls in a US government-affiliated environment, extracting running configurations, performing credential extraction, and launching Active Directory enumeration. The recovered artifacts confirm this was not opportunistic scanning but a deliberate intelligence operation with a clear targeting logic aligned to Chinese strategic interests in the Pacific theater. Evidence of AI-assisted tooling was present in the attack infrastructure: Claude Code had been installed, an offensive security platform called aiscan was configured with DeepSeek and Kimi (Chinese LLMs), and API keys for FOFA were recovered. The code structure and commenting consistency across approximately 40 custom post-exploitation scripts suggest AI-assisted development, though Dream stops short of claiming fully autonomous operation. The 11 JSON version profiles — each containing exact libphp.so offsets, SHA256 hashes, ELF build IDs, and memory geometry parameters — demonstrate methodical lab testing across PAN-OS branches. The operational pattern is what matters for defenders. Exposed management interfaces on firewalls are not theoretical risk — they are the literal front door. The attacker moved from internet scan to domain compromise in under three weeks (infrastructure setup began October 8, exploitation and post-exploitation ran through October 24). Palo Alto Networks' Unit 42 independently verified the tooling and results and is releasing fixed PAN-OS versions. Dream conducted the research using its autonomous threat-hunting product, Hero. This is a textbook illustration of how perimeter security devices become the attack surface. The firewalls were not bypassed; they were the target. The 19,000 exposed management interfaces discoverable via certificate fingerprints represent a systemic failure of deployment hygiene across organizations worldwide. For the 22 parked webshells, the attacker retains persistent access until those devices are patched and forensically examined — a ticking clock that most affected organizations may not yet know is running.
