Cyber Attack Targets Palo Alto Networks with PHP2Shell and Fragnesia Flaws
Recent findings have revealed a sophisticated cyberattack that exploits critical vulnerabilities in PHP2Shell, coupled with a significant flaw in the Fragnesia Linux kernel, to gain root access to Palo Alto Networks’ PAN-OS systems. The attackers have successfully compromised 25 systems, including 24 internet-facing firewalls and an internal firewall management server.
According to an investigation by Hunt.io, in collaboration with campaign analysis from Dream Research, this breach signifies a troubling transition from the exploitation of honeypots to actual, in-the-wild compromises. This indicates a serious escalation in the tactics employed by the threat actors involved, raising alarms in the cybersecurity community.
Exploitation Details and Attack Vector
The attackers utilized vulnerabilities categorized under PHP2Shell, specifically CVE-2026-109618 and CVE-2026-109619, which are critical memory-safety flaws that can lead to remote code execution. Rated with a CVSS score ranging from 4.0 to 9.2, these vulnerabilities specifically relate to PHP’s session-upload handling and memory cleanup processes during out-of-memory scenarios. This makes vulnerable systems particularly susceptible to remote exploitation.
The attack begins through the mechanism responsible for PHP session upload progress, which allows for processed attacker-controlled multipart upload data. By manipulating heap allocations and exposing critical memory addresses, the assailants can bypass address space layout randomization (ASLR), redirecting execution to PHP’s vulnerable system() function.
For the specific attack on PAN-OS, the operators developed a custom implementation that did not rely on a publicly available proof of concept. Instead, they tailored their attacks by using version-dependent offsets and optimized heap layouts for the specific appliances they targeted. This level of customization illustrates the attackers’ understanding of the infrastructure they were attempting to breach and highlights the sophisticated nature of their methods.
Escalation of Privileges
Once the attackers initially executed their code within the restrictive web-server context, they then exploited the Fragnesia kernel vulnerability, identified as CVE-2026-46300, to escalate their privileges to root. Hunt.io identified a critical link between the reliability of this chained exploitation and the uniform PHP version, 8.0.30, that was employed in the compromised management environment.
The investigation revealed that the attackers had uncovered approximately 19,000 exposed firewalls identified through FOFA’s resources. Subsequent fingerprinting returned around 5,000 responsive devices, which were then narrowed down to a targeted pool of 240 based on geographic and software version filters. Ultimately, automated exploitation enabled the attackers to compromise a substantial number of perimeter firewalls.
Persistence and Data Exposure
As part of this operation, the attackers established a persistent reverse SSH tunnel into environments connected with U.S. government operations. They subsequently exploited this access against an internal firewall management server, bringing the total compromised systems to 25. This latter breach exposed sensitive configurations and directory service credentials, heightening the stakes in an already alarming situation.
In a related finding, Hunt.io uncovered files named panos_rce_poc.py and prce.py within an exposed directory, demonstrating the adaptation of PHP2Shell for usage with PAN-OS. However, it is important to note that while these exploits were available, they do not necessarily confirm that specific targets were successfully compromised.
Recommendations for Mitigation
In light of this incident, organizations utilizing PAN-OS should prioritize vendor-supported remediation measures while also limiting exposure to management interfaces. For standalone PHP environments, it is advisable to move towards fixed releases such as 8.2.35, 8.3.36, 8.4.27, or 8.5.12, based on the specific branch in question.
If immediate patching is not feasible, disabling session.upload_progress.enabled could serve as a temporary safeguard against the upload-progress attack route. Defenders are encouraged to carefully analyze multipart uploads, oversized PHPSESSID cookies, abnormal web-server processes launching shells, and any unexpected outbound connections. It is crucial to correlate these indicators with management access logs and any signs of unauthorized persistence or lateral movement within the network.
Conclusion
This sophisticated multi-layered attack represents a significant evolution in cyber warfare tactics. As the threats against critical infrastructure continue to grow in complexity and frequency, organizations must adopt proactive cybersecurity measures to safeguard their systems and data against such intrusions. The implications of this breach offer a stark reminder of the ongoing vulnerabilities in widely used software, underscoring the importance of vigilance in cybersecurity practices.