# Custom PHP2Shell and Linux kernel exploit chain used to root Palo Alto Networks firewalls

> **Key takeaway:** Attackers chained unauthenticated PHP memory corruption bugs with a Linux kernel privilege escalation flaw to gain root access to network infrastructure.

**Published:** 2026-10-29T19:05:17+00:00 
**Source:** The Register 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/custom-php2shell-and-linux-kernel-exploit-chain-used-to-root.html 

## Summary
Security researchers at Dream have identified a sophisticated attack campaign where suspected Chinese actors used a custom exploit chain to compromise 25 servers. The attack specifically targeted Palo Alto Networks firewalls running PAN-OS 12.1 and 12.2, which utilize PHP 8.0.30. By combining the PHP2Shell vulnerability with a Linux kernel flaw, the attackers were able to move from an unauthenticated HTTPS request to full root access in under 15 minutes.

The campaign has impacted organizations across the United States, Japan, Taiwan, and South Korea, including US government-affiliated entities. Once root access was achieved, the attackers deployed approximately 40 custom post-exploitation scripts to conduct Active Directory attacks, steal credentials, and attempt to establish persistent remote access. The Linux kernel component used for privilege escalation has since been added to CISA's Known Exploited Vulnerabilities catalog.

## Technical breakdown of the exploit chain
- **PHP2Shell (CVE-2026-109618 & CVE-2026-109619):** A two-part unauthenticated remote code execution vulnerability (CVSS 9.2) that uses crafted multipart POST requests to corrupt PHP memory and force a predictable memory layout.
- **Memory Corruption Mechanism:** The exploit uses an out-of-bounds read to expose the base address of libphp.so and subsequently forces mod_data=NULL to create a stale reference, allowing command execution as the 'nobody' user.
- **Fragnesia (CVE-2026-46300):** A high-severity local privilege escalation vulnerability in the Linux kernel's XFRM ESP-in-TCP subsystem used to elevate 'nobody' user permissions to root.
- **Target Environment:** The attack specifically leveraged the high memory limits configured in PAN-OS 12.1 and 12.2 to facilitate the memory-corruption stages of the PHP2Shell exploit.

## Why it matters
This incident highlights the critical risk of exposing management interfaces to the public internet and the danger of chaining web-layer vulnerabilities with kernel-level flaws. System administrators must prioritize patching both PHP environments and the Linux kernel, specifically addressing the XFRM ESP-in-TCP subsystem to prevent local privilege escalation.