PHP2Shell Exploited: Palo Alto Firewalls Compromised

Cybersecurity researchers have confirmed the first successful exploits of the PHP2Shell vulnerability, a critical flaw that initially caused widespread concern due to its prevalence in web applications. The attacks, attributed to Chinese threat actors, specifically targeted Palo Alto Networks firewalls running outdated versions of their operating system. These sophisticated attacks chained the PHP2Shell vulnerability with a Linux kernel privilege-escalation flaw, known as Fragnesia (CVE-2026-46300), to achieve root access and establish persistence.

The compromise escalated rapidly; within minutes of gaining access to a US government-affiliated firewall on October 23, 2026, attackers infiltrated the internal network. They leveraged the same PHP2Shell exploit to compromise additional servers and initiated a full Active Directory attack campaign. This entire chain, from an unauthenticated HTTPS request to a persistent root webshell, reportedly completed in under 15 minutes. Evidence suggests attackers utilized AI tools such as Claude Code and AIscan, alongside Chinese AI models DeepSeek and Kimi, and API keys for the FOFA search engine to identify vulnerable devices.

The attackers' endgame remains undetermined, though possibilities include deploying backdoors or exfiltrating sensitive data. While the attack was not fully automated, the rapid progression and sophisticated methodology underscore the urgent need for organizations to patch their systems. The identified targets included approximately 19,000 internet-connected Palo Alto Networks firewalls worldwide.