Chinese Hackers Chain PHP2Shell to Root Servers and Breach US Government-Affiliated Firewalls

Cybersecurity researchers report the first confirmed compromises involving the PHP2Shell vulnerability, with attackers successfully targeting organizations linked to the US government. According to reports, threat actors chained PHP2Shell with a Linux kernel privilege-escalation flaw to gain root access and persistent control.

The Attack Chain and Methodology

Security firm Dream stated that the campaign began around October 23, 2026, targeting firms across the US, Japan, Taiwan, and South Korea before focusing on Palo Alto Networks devices running older, vulnerable versions of PAN-OS.

• Initial Access: Attackers utilized an unauthenticated HTTPS request to an exposed management interface.
• Privilege Escalation: The PHP2Shell flaw was chained with Fragnesia (CVE-2026-46300), a local privilege escalation vulnerability disclosed earlier in May 2026.
• Execution: Attackers executed roughly 40 custom post-exploitation scripts, progressing from initial compromise to internal network tunneling and Active Directory attacks in under 15 minutes.

Tooling and Intelligence Gathering

Researchers discovered evidence of tool usage during the incidents, including the FOFA search engine, which helped attackers allegedly identify approximately 19,000 internet-connected Palo Alto Networks firewalls. Evidence of AI assistance—such as Claude Code, AIscan, and API keys for Chinese models DeepSeek and Kimi—was also found, though analysts believe the attacks were not fully automated.

Verification and Practical Implications

Organizations utilizing Palo Alto Networks firewalls or PHP-based applications should review exposure management interfaces and apply available vendor patches. Original announcements and technical indicators can be verified through cybersecurity advisories issued by security firms and official vendor channels.