A recent investigation has uncovered a sophisticated cyber campaign attributed to a suspected Chinese nation-state actor, which involved the exploitation of a critical vulnerability known as PHP2Shell combined with a Linux kernel privilege-escalation flaw. This operation successfully gained root access to 25 Palo Alto Networks (PAN) firewall and management servers located across several countries, including the United States, Japan, Taiwan, and South Korea. The findings were reported by Dream, a cyber defense platform that specializes in network security.
The malicious activity was particularly centered around three servers affiliated with a U.S. government organization, leading to continued access to the internal Active Directory domain of the targeted entity. According to the researchers from Dream, this targeted approach reveals significant indicators of a nation-state involvement due to the specificity and focus of the attacks. “The U.S., Japan, Taiwan, and South Korea are viewed as primary strategic adversaries by Chinese state-aligned cyber operations in the Pacific theater, which suggests that this operation is part of broader national adversary efforts,” they remarked.
Adding weight to this assertion, the tools employed during the campaign—such as DeepSeek and Kimi, both large language models, and FOFA, known for internet reconnaissance—are associated with Chinese-based digital services. The automated nature of the exploits was noted, which occurred over a short period from October 23 to 24, specifically targeting certain versions of the PAN-OS software.
The depth of preparation demonstrated by the attackers sets this incident apart from typical opportunistic exploitation. Dream’s researchers detailed the attackers’ commitment to vulnerability research, which involved obtaining PAN-OS firmware, decrypting it, extracting PHP libraries, constructing specific memory profiles for nine different software versions, and conducting lab tests to fine-tune the exploit geometry.
In a related confirmation, Palo Alto Networks’ threat intelligence team, known as Unit 42, corroborated Dream’s findings in a blog post released on October 29. According to their report, approximately 0.02% of their global installed client base includes internet-facing management interfaces that had been affected by the cyber campaign. All impacted devices run specific versions of PAN-OS, and the company has actively reached out to affected customers. Unit 42 has advised these users to review the security mitigations concerning CVE-2026-109618 and CVE-2026-109619 and urged them to apply available patches without delay.
The method employed by the attackers involved developing two separate exploits that they ingeniously chained together into a single request to target the PAN-OS servers. One component of the operation was the PHP2Shell exploit, which consists of two vulnerabilities labeled as CVE-2026-109618 and CVE-2026-109619. With PHP being used by approximately 70% of websites, its compromise led to extensive disruptions, including the shutdown of websites before the planned disclosure and patch release.
Once the exploit was tailored for PAN-OS, the threat actors carried out an extensive reconnaissance effort, identifying around 19,000 internet-facing PAN-OS firewalls globally. They then narrowed their focus using various scanning techniques to determine the geographic locations of these devices and the specific versions of PAN-OS they were using. Ultimately, this process boiled down to a refined target list comprising 240 firewalls in the U.S., Japan, Taiwan, and South Korea.
The attackers executed their exploits efficiently, compromising five targets at a time with a 30-minute timeout per target. Out of the 240 targeted firewalls, they successfully rooted 24, although in 22 cases, they only planted a webshell without further exploitation. However, two of the compromised firewalls were linked to a U.S. government-affiliated environment, allowing the attackers to set up persistent access. This included creating an 8-port reverse SSH tunnel connecting the breached firewall back to the perpetrators.
Using their foothold in one of the government servers, the attackers quickly moved to exploit a third server, again utilizing the PHP2Shell and Fragnesia exploit chain. This escalation brought the total number of exploited servers to 25. The compromised third server managed all firewalls of the governmental organization, giving the attackers extensive access to crucial configurations, credentials, and network settings.
This compromised access made it possible for the adversaries to exploit the server’s connectivity to the Active Directory, enabling data breaches that could include sensitive credentials. Nonetheless, researchers were unable to ascertain the full extent of the data accessed. They cautioned, “It is uncertain whether the password spray, backdoor account creation, or SAML key extraction succeeded. If any of these attempts were fruitful, the compromise could extend beyond the perimeter firewalls to impact the organization’s foundational identity infrastructure.”
The incident underscores the pressing need for organizations to not only identify vulnerabilities within their systems but also to develop a holistic approach to security that considers the implications of chained exploits. Dream stressed, “Defenders must pinpoint exposed systems, understand what could be exploited, and take action to prevent a foothold from snowballing into a larger compromise.”