China-linked Group Roots 25 Palo Alto PAN-OS Firewalls via PHP2Shell-Fragnesia Exploit Chain

Threat actors have scanned and exploited PHP2Shell flaws across more than 22.6 million exposed PHP instances since mid-October. Only a narrow subset succeeded: Dream Research and Unit 42 confirmed the China-linked campaign compromised 25 of several hundred targeted PAN-OS devices by chaining the two PHP2Shell RCE bugs directly into Fragnesia for root webshell deployment. Palo Alto Networks issued patches for PAN-OS 10.2 through 12.2 and contacted the roughly 0.02 percent of customers with exposed management planes.

Defiant telemetry recorded over 77,000 PHP2Shell requests against WordPress sites from more than 2,000 IPs yet observed zero confirmed compromises. The exploits repeatedly failed due to ASLR, PHP build variations, and memory limits, forcing attackers to iterate PoCs manually. Cato Networks blocked 96 percent of attempts against CVE-2026-109618, with 41 percent attempting actual RCE; the remaining traffic consisted of repetitive scanning from a handful of US, Dutch, and German IPs.

The pattern reveals that default-exposed management interfaces on critical network appliances remain higher-value targets than commodity web applications. Palo Alto’s advisory states no special configuration is required for exposure, contradicting years of repeated customer guidance to isolate these planes. Healthcare and technology sectors absorbed the highest volume of probes, indicating opportunistic rather than precision targeting.

Patches are now available; organizations must restrict management access and apply fixes within days. Continued monitoring of the same small IP set will show whether the actors shift to newly disclosed kernel flaws or broaden their PHP2Shell variant testing.