Top stories

Dream researchers said they uncovered a campaign that used a custom PHP2Shell exploit chain and the Fragnesia Linux kernel privilege-escalation flaw to root 25 Palo Alto Networks PAN-OS firewall and management servers. The campaign targeted internet-exposed PAN-OS management interfaces, including the GlobalProtect portal, and affected systems in the United States, Japan, Taiwan and South Korea. Palo Alto Networks’ Unit 42 independently verified the tooling and results and is releasing fixed PAN-OS versions for affected branches. The attackers reportedly scanned about 19,000 exposed devices, identified 5,000 responsive systems, narrowed the list to 240 targets matching tested PAN-OS versions, and rooted 24 firewalls. The exploit chain combined unauthenticated remote code execution in PHP2Shell, identified as CVE-2026-109618 and CVE-2026-109619, with Fragnesia, CVE-2026-46300, to obtain persistent root access in under 15 minutes. Dream said the attackers planted webshells and later used a compromised firewall at a US government-affiliated organization to establish a reverse SSH tunnel, compromise an internal firewall management server, decrypt LDAP credentials, and enumerate Active Directory users and groups. Dream found Claude Code, the aiscan offensive-security platform configured with DeepSeek and Kimi, and FOFA API keys in the attack infrastructure. It found no direct evidence that AI wrote the exploit or scripts, though it said the consistency of roughly 40 custom scripts suggested AI-assisted development. Unit 42 tracks the activity as CL-UNK-1280 and attributes it to a Chinese-speaking attacker in the UTC+8 time zone.