A suspected China-nexus hacking group rooted at least two dozen Palo Alto Networks firewalls and management servers across the United States, Japan, Taiwan and South Korea by chaining two separate vulnerabilities together, according to researchers who tracked the campaign through late October. One of the compromised servers centrally managed firewalls for a U.S. government-affiliated organization, underscoring how a single exploited management interface can cascade into access over an entire fleet of devices.
The attackers combined a PHP exploitation technique researchers call PHP2Shell — which abuses how PHP handles session upload progress tracking to achieve code execution without any credentials — with a separate Linux kernel privilege-escalation flaw known as Fragnesia, tracked as CVE-2026-46300. Palo Alto Networks' appliances bundle their own PHP runtime inside the management web interface, which includes both the HTTPS web console and its XML API; the PHP Foundation patched the underlying flaw upstream on October 21, but PAN-OS needed its own hotfixes because of that bundled runtime. Field Effect's technical write-up describes the full chain — from initial access to root — as taking under 15 minutes once a vulnerable device was identified.
Scanning the Internet for Targets
Researchers say the attackers used the FOFA search engine, a tool that indexes internet-facing devices, to narrow roughly 19,000 exposed PAN-OS and Panorama management interfaces down to about 240 targets running vulnerable 12.1 and 12.2 releases, then automated the exploitation against that shortlist. Once inside, the group deployed web shells, opened reverse SSH tunnels back to its own infrastructure, harvested an LDAP service account password, and used it to run password-spraying attempts and reconnaissance against the victim's Active Directory environment — the kind of foothold that can persist long after the original vulnerability is patched.
Palo Alto Networks confirmed active exploitation against internet-exposed management interfaces on October 28 and said roughly 0.02% of its installed base was exposed to the internet and potentially affected. CISA added the Fragnesia kernel flaw to its Known Exploited Vulnerabilities catalog the same day, noting explicitly that it can be chained with PHP2Shell to deploy web shells and execute commands as root. Cybersecurity Dive's coverage frames the episode as a reminder that when vendors' management software is breached, it is customers — not the vendor — who absorb the damage, since firewalls sit at the center of an organization's network and typically fall outside standard endpoint detection coverage.
Hotfixes are now available for most PAN-OS and Panorama maintenance branches, with the remaining releases patched by October 30. Palo Alto Networks is urging customers to restrict management-interface access to trusted internal IP addresses regardless of patch status, and to check whether any dataplane interfaces have a management profile attached — a configuration that can expose the same vulnerable interface even on a device that looks, on paper, like it has no management access exposed to the internet at all.
