A sophisticated cyberattack by a suspected Chinese nation-state actor has compromised 25 Palo Alto Network firewall and management servers across the United States, Japan, Taiwan, and South Korea. The attack utilized a chained exploit involving the PHP2Shell vulnerability and a Linux kernel flaw known as Fragnesia, allowing the threat actor to gain root access to these systems. Notably, three of the targeted servers were part of a US government-affiliated network, resulting in persistent access to the internal Active Directory domain of the organization.
According to Dream, a cyber defense platform provider, the attackers demonstrated significant preparation and capability, targeting specific versions of PAN-OS with precision. The attackers employed Chinese-based tools such as DeepSeek and Kimi, and leveraged platforms like FOFA for reconnaissance, indicating a high level of automation and strategic focus on government targets.
Palo Alto Networks’ Unit 42 confirmed Dream's findings, reporting that a small percentage of its global installed base with internet-facing management interfaces was affected. They have reached out to the impacted customers and are investigating the incident further. The company urged users to apply patches for vulnerabilities CVE-2026-109618 and CVE-2026-109619 to mitigate the risk.
The attackers tailored their exploit to target PHP's session.upload_progress mechanism on PAN-OS management web servers. By chaining this with the Fragnesia vulnerability, they managed to overwrite authentication rules, thus gaining unauthorized root access. The campaign was executed swiftly, with the entire exploit chain completing in under 15 minutes per target.
From the approximately 19,000 potential targets, the attackers narrowed down their focus to 240 firewalls, ultimately rooting 24 of them successfully. While most were only used to plant a webshell, the two government-affiliated firewalls were exploited further, granting the attackers extensive access to network configurations and potentially sensitive data. The breach underscores the importance of identifying vulnerabilities and addressing them promptly to prevent such extensive compromises.
