PHP2Shell: Custom PAN-OS Exploit Roots 25 Servers in Under 15 Minutes

A suspected Chinese nation-state actor developed an independent, non-public PHP2Shell exploit calibrated for nine specific Palo Alto Networks PAN-OS versions and chained it with a Linux kernel privilege escalation to gain root on 25 servers in the United States, Japan, Taiwan, and South Korea. The full chain — from unauthenticated HTTPS connection to persistent root webshell — completes in under 15 minutes. The disclosure came on October 29, 2026, from Dream Research, with independent confirmation from Palo Alto Networks Unit 42.

The "Custom Build Paradox": Preparation vs. Reactive Patching

The significance of this campaign lies not in the vulnerability itself. PHP2Shell was already known: Amazon detected exploitation attempts on October 17, 2026, six days before the main wave. What Dream recovered is an implementation developed from scratch for the PAN-OS platform, with lab-tested memory profiles for each target build.

Researchers found 11 JSON profile files for 9 PAN-OS versions, containing exact offsets, SHA256 hashes, ELF build IDs, and memory geometry parameters. Some profiles are marked "calibrated," others "provisional," indicating a continuous refinement process. This level of preparation challenges the defensive assumption that critical risk clusters around day zero or public PoC release.

"Both exploits run in a single B2 HTTP request. The total chain — from unauthenticated HTTPS connection to persistent root webshell — completes in under 15 minutes" — Dream researchers

How the Chain Works: From Web Management to Kernel

The entry point is the PAN-OS management interface exposed over HTTPS, running PHP 8.0.30 with an elevated memory limit. The exploit leverages PHP's session.upload_progress mechanism for memory corruption, achieving code execution as user nobody. At that point Fragnesia (CVE-2026-46300) takes over: an attack on the Linux kernel's XFRM ESP-in-TCP subsystem that overwrites /etc/pam.d/su with pam_permit.so, enabling passwordless su to root.

The transition from web process compromise to kernel escalation bypasses SELinux confinement on httpd_t. The exploit then plants a 103-byte PHP webshell in a publicly accessible directory. All in a single B2 HTTP request.

The Targeting Funnel: From 19,000 to 25

The attacker's infrastructure reveals a methodical selection process. According to Dream, the actor identified roughly 19,000 PAN-OS firewalls with management interfaces exposed to the internet via the FOFA platform, probed about 5,000 for version, filtered 240 matching the target builds in geographically relevant regions (U.S., Japan, Taiwan, South Korea), and ultimately compromised 24 firewalls plus one additional internal server.

The automated exploitation success rate is 10%: 24 roots from 240 targets. Twenty-two firewalls received only the webshell. Two, both government-affiliated, drew additional attention. On one, the actor generated 900 MB of exploit traffic, causing the device to crash and go permanently offline.

From Perimeter to Identity: The Active Directory Attack

The second government firewall hosted an 8-port reverse SSH tunnel to the attacker's infrastructure. Through this tunnel, the actor reached a third system: an internal centralized firewall management server with access to all managed configurations, credentials, and network settings.

From this position, the attack pivoted to Active Directory. Dream researchers confirm credential extraction and user/group enumeration, along with password spray attempts, backdoor account creation, and SAML key extraction. However, they explicitly state it is not possible to determine whether these subsequent actions succeeded.

"The operation illustrates how an exposed management interface can become a path into an organization's identity infrastructure" — Dream researchers

AI Tooling: Accelerator, Not Author

Traces of AI tooling surfaced on the recovered infrastructure: installation of Anthropic's Claude Code, an aiscan platform configured with DeepSeek and Kimi LLMs, and FOFA API keys. According to Dream, "the code structure, comment style, and consistency across roughly 40 scripts suggest AI-assisted development." However, the source notes that "there is no direct evidence that AI tools were used specifically to write the exploit" and that "this operation does not appear to be a fully autonomous nation-state attack."

The editorial angle here is the compression of the development cycle: even if the core exploit remains human work, acceleration in support systems further shrinks the defender's response window.

Immediate Actions

• Eliminate internet exposure of PAN-OS management interfaces: Palo Alto Networks Unit 42 confirms only about 0.02% of the global installed base had these configurations, but that fraction drew the attention of a prepared state actor.
• Inventory PHP dependencies in embedded and OT systems often excluded from patching cycles, including network devices with integrated web servers that fall outside standard enterprise application controls.
• Monitor exploit chains combining web RCE with kernel escalation: compromise of the web process alone is not contained if the attacker can transition to root in a single request.
• Treat every management firewall compromise as a potential Active Directory compromise until proven otherwise, with immediate verification of anomalous accounts, SAML configurations, and active tunnels.

The Wrong Risk Metric

The lesson of the PHP2Shell campaign is not that a new vulnerability struck. It is that an actor had already moved past the known-vulnerability phase into a private weapon while the industry still assessed risk based on public PoC availability. The line between manageable exposure and catastrophe is not drawn by exploit publication, but by the preparation of whoever chooses the target.

The SSH tunnel in the U.S. government system, per Dream, "is presumably still active." CISA added CVE-2026-46300 to the KEV catalog on October 28, 2026. Unit 42 contacted affected customers individually. But for organizations outside the identified 0.02%, the question remains: how many other exposed management interfaces are waiting for the right profile?

FAQ

Is the PHP2Shell exploit used publicly available?

No. According to Dream, the recovered implementation is "a custom build, not public, not a copy of any known public exploit for PHP2Shell." It was developed independently and calibrated specifically for PAN-OS.

How many government servers were compromised?

Two firewalls affiliated with an unidentified U.S. government organization were rooted. One crashed, the other hosts a reverse SSH tunnel. A third internal management server was reached via the tunnel.

Is the actor attributed to a specific APT group?

No. Dream attributes the activity to a "suspected Chinese nation-state actor" but does not name a specific APT group. The Record reports that CISA declined to comment on the specific breach.