The firewall is meant to be the last thing on a network that gets owned. A campaign that researchers at Dream Research uncovered this week went after exactly that box. It chained two separate bugs, one in the PHP code running inside Palo Alto Networks' PAN-OS management web server and one in the Linux kernel underneath it, to get full root control of 25 firewall and management servers.

Palo Alto Networks has confirmed the exploitation. Its advisory for the PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619, now lists exploit maturity as "ATTACKED." The company's Unit 42 threat intelligence team says it independently verified the attackers' tooling. On Wednesday the US Cybersecurity and Infrastructure Security Agency (CISA) added the kernel half of the chain, a bug Dream calls Fragnesia (CVE-2026-46300), to its Known Exploited Vulnerabilities catalog, with a remediation deadline of Oct. 31.

Two bugs, one chain

The intrusion has two stages, and each one does a different job.

Stage one: PHP2Shell. CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, the scripting language behind many web applications, including the PAN-OS management interface. Palo Alto and Unit 42 both rate the pair 9.2 under CVSS 4.0, the current version of the industry's standard severity score. According to Dream Research, the attackers built a custom exploit for them, a non-public build tailored to PAN-OS rather than a copy of any known public exploit, and aimed it at the PAN-OS management web server. A successful hit gives the attacker code execution on the device as the unprivileged "nobody" account. That access is limited, but it is a foothold.

Stage two: Fragnesia. The foothold then needs to become full control. That is where CVE-2026-46300 comes in. According to the National Vulnerability Database, it is a flaw in a Linux kernel networking function, skb_try_coalesce(), which merges chunks of network data in memory. When it merges them, the function can drop a marker that says a piece of memory is shared. Without that marker, the kernel's IPsec ESP code (the part that decrypts encrypted VPN traffic) can decrypt data "in place" over memory that also backs cached files. In plain terms, a process that should not be able to modify certain data ends up able to change it. NVD scores the bug 7.8 (High) under CVSS 3.1. Its attack vector is local and it needs low privileges, so on its own it is not a way in from outside. It is a privilege-escalation bug: it turns a low-privilege foothold into root. CISA's catalog entry notes that it can be chained with the two PHP flaws to run commands as root.

The kernel bug is not new. NVD published it on May 23, 2026, and the Linux kernel stable branches have fixes. What is new is that someone has paired it with a remote entry point on a high-value appliance. According to The Register, quoting Dream, the chain from an unauthenticated HTTPS connection to a persistent root webshell completes in under 15 minutes.

Who was hit

The Register reports that exploitation began on Oct. 23 and targeted PAN-OS 12.1 and 12.2. Dream Research says it discovered the activity on Oct. 25 and updated its findings on Oct. 29. It counted 25 rooted PAN-OS firewall and management servers across the United States, Japan, Taiwan and South Korea.

The most serious detail in Dream's report is that the attackers focused on three servers in what it describes as a US government-affiliated environment, and launched attacks against that organization's Active Directory. Dream says the recovered artifacts confirm credential extraction and directory enumeration. Active Directory is the Windows identity system that controls who can log in to what across an organization. A firewall used as a springboard into it is far more than a perimeter problem.

Dream says it recovered about 40 custom post-exploitation scripts, meaning the tools an attacker runs after getting in. It and The Register report that the operators used FOFA, an internet-device search engine, to identify about 19,000 internet-facing Palo Alto firewalls worldwide as possible targets. On attribution, Dream says it does not attribute the activity to a named threat actor, but lists indicators pointing to a Chinese-nexus operation, such as UTC+8 timestamps and Chinese-language prompts in the tooling. Dream also says Unit 42 tracks the activity as CL-UNK-1280 and attributes it to a Chinese-speaking attacker. The Register describes the attackers as suspected Chinese actors. Treat that as the researchers' assessment, not a settled finding. The Register says CISA and the FBI declined to comment.

Unit 42 gives a sense of scale. Palo Alto's Cortex Xpanse attack-surface service identified over 22.6 million exposed instances potentially vulnerable to the two PHP flaws, a reminder that PHP runs far beyond Palo Alto products. Among Palo Alto customers, Unit 42 says approximately 0.02% of the global installed base had internet-facing management interfaces configured and was impacted. It also says customers who had applied the patches were not affected.

The AI angle, and what it doesn't mean

Dream Research says the attackers' environment contained signs of AI tooling: Claude Code had been installed, an AI-powered offensive security platform called aiscan was configured with the DeepSeek and Kimi models, and API keys for FOFA were present. Dream's conclusion is measured. It says it has no direct evidence the AI tools were used to write the exploit or the scripts, though the code structure and commenting style across the roughly 40 scripts suggest AI-assisted development. It adds that the operation does not appear to be a fully autonomous nation-state attack.

That distinction matters. The plausible reading of Dream's findings is that AI helped people work faster, most likely on the scripting. It is not a machine-run intrusion. The defensive lesson is also unchanged. A chain that goes from an unauthenticated connection to root in under 15 minutes leaves little room between "a fix exists" and "we applied it." Faster attackers make slow patching more costly. They do not change what needs patching.

Why the management interface keeps coming up

The campaign depended on one condition: the PAN-OS management web server was reachable from the internet. That interface is the administrative console for the firewall. Palo Alto's advisory says the risk is highest when management access is allowed from external internet addresses, and Unit 42 says the management interface is not exposed to the internet by default under security best practices. Dream called it a management interface that should never have been exposed. Unit 42's guidance repeats the point: remove public access to management.

The small share of affected customers is consistent with that. Organizations that kept management on an internal network or behind a jump host reduced their exposure to the PHP2Shell entry point. Without that entry point, Fragnesia had no foothold to escalate from.

What It Means for Defenders

Who is affected: Organizations running PAN-OS with the management interface reachable from the internet are at highest risk, especially on the 12.1 and 12.2 branches that The Register says were targeted first. Palo Alto's advisory lists fixes across the 12.2, 12.1, 11.2, 11.1 and 10.2 lines, so other branches are in scope as well. The advisory says GlobalProtect and the captive portal are not impacted, and that Cortex, Prisma and the GlobalProtect app are not affected.

Patch PAN-OS. Palo Alto says its hotfixes address both PHP flaws, and Unit 42 says the fixes interrupt the observed exploit chain. According to the advisory, the fixed builds include:

  • PAN-OS 12.2: 12.2.4-h1
  • PAN-OS 12.1: 12.1.4-h13, 12.1.7-h11, 12.1.10-h3
  • PAN-OS 11.2: 11.2.4-h23, 11.2.7-h23, 11.2.10-h16, 11.2.13-h4, 11.2.16-h1
  • PAN-OS 11.1 and 10.2: hotfix builds listed in the advisory

The advisory was published Oct. 21 and updated Oct. 29. It also notes that 11.2.10-h16 covers only the PHP flaws, while 11.2.10-h17 adds a fix for a separate brotli vulnerability. Check the advisory directly for the exact build that matches your maintenance release.

Take management off the internet today. If your PAN-OS management interface can be reached from the public internet, restrict it to trusted internal addresses or a dedicated management network now, even before patching. Unit 42 and the advisory both recommend this.

Patch the kernel elsewhere too. Fragnesia (CVE-2026-46300) is a general Linux kernel bug, not something specific to Palo Alto. Any Linux system where an attacker could get a low-privilege foothold, such as web servers, shared hosts or container hosts, should be on a kernel that includes the stable-branch fix. CISA's KEV catalog set an Oct. 31 due date for it, which applies to US federal civilian agencies. Other organizations should treat it as a strong signal.

Hunt if you were exposed. If your management interface was internet-facing at any point since Oct. 23, assume compromise until you have ruled it out. Patching closes the entry point but does not remove an attacker who is already inside. Review the device for unexpected scripts, web shells and accounts. Because Dream found Active Directory attacks staged from rooted firewalls, also review AD for suspicious authentication from firewall or management IP addresses. Rotate any credentials stored on or used by the device, including administrator, service and directory-integration accounts. Engage Palo Alto support or an incident response provider if you find signs of intrusion.

Small businesses: If a managed service provider runs your firewall, ask them two questions this week. Is the management interface reachable from the internet? Is the device on one of the fixed builds above? Get both answers in writing.

Sources