Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls

Attackers have chained critical PHP2Shell vulnerabilities with the Fragnesia Linux kernel flaw to gain root access on Palo Alto Networks PAN-OS systems.

The campaign reportedly compromised 24 internet-facing firewalls before reaching an internal firewall management server, bringing the total to 25 compromised systems.

Hunt.io’s investigation cites Dream Research’s campaign analysis and describes a transition from honeypot exploitation to production compromises.

Hackers Exploit PHP2Shell RCE Vulnerabilities

However, the findings do not establish reliable mass exploitation across arbitrary PHP servers, where differing software builds and memory layouts complicate successful attacks.

PHP2Shell comprises CVE-2026-109618 and CVE-2026-109619, two critical memory-safety vulnerabilities rated CVSS 4.0 9.2. The flaws involve PHP session-upload handling and memory cleanup during out-of-memory conditions, potentially enabling remote code execution in vulnerable configurations.

The attack begins through PHP’s session.upload_progress mechanism, which processes attacker-controlled multipart upload data.

Crafted requests manipulate heap allocations, expose memory addresses needed to bypass address space layout randomization, and forge internal structures that redirect execution to PHP’s system() function.

For PAN-OS, the operator developed a custom, non-public implementation targeting the appweb management server. Rather than deploying an unchanged public proof of concept, the attacker used version-dependent offsets and calibrated heap layouts tailored to the appliance environment.

Initial execution occurred within the restricted web-server context. The attacker then exploited Fragnesia, tracked as CVE-2026-46300, to escalate privileges to root. Hunt.io linked the chain’s reliability to the uniform PHP 8.0.30 build used by the targeted management environment.

Recovered campaign evidence showed approximately 19,000 exposed firewalls identified through FOFA. Fingerprinting returned around 5,000 responsive devices, and geographic and software-version filtering reduced the attack pool to 240 selected targets.

Automated exploitation subsequently compromised 24 perimeter firewalls. The attacker established a persistent reverse SSH tunnel into a United States government-affiliated environment, then reused the chain against an internal firewall management server.

That additional compromise increased the reported total to 25 systems and exposed management configurations and directory-service credentials.

Separately, Hunt.io identified panos_rce_poc.py and prce.py in an exposed directory at 130.94.67[.]235. The files demonstrate adaptation of PHP2Shell to PAN-OS, but exposed exploit tooling alone does not prove successful compromise of any particular target.

Organizations should prioritize vendor-supported PAN-OS remediation and restrict management-interface exposure. Standalone PHP deployments should move to fixed releases: 8.2.35, 8.3.36, 8.4.27, or 8.5.12, depending on branch.

Where patching must wait, disabling session.upload_progress.enabled provides temporary protection against the upload-progress attack path.

Defenders should investigate anomalous multipart uploads, oversized PHPSESSID cookies, web-server processes launching shells, and unexpected outbound connections. Correlate these signals with management access logs and evidence of unauthorized persistence or lateral movement.

IOCs

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team