Security researchers at Dream report that attackers rooted 25 servers across the United States, Japan, Taiwan and South Korea, including Palo Alto Networks firewalls linked to US government-affiliated organisations. The campaign began on 23 October, with the first such firewall rooted that day and a second the following day. Palo Alto Networks' Unit 42 team independently verified the attacker's tooling and confirmed Dream's findings, according to both The Register and eSecurity Planet.

From one web request to full root access

The attack chain started with a single unauthenticated HTTPS request to a firewall management interface that, the researchers argue, should never have been exposed to the internet. Within hours of one compromise, the attackers had tunnelled into the internal network, hit a third server with the same exploit and begun an Active Directory attack, stealing credentials and other sensitive information.

How the chain fits together

The entry point was PHP2Shell, two PHP remote-code-execution flaws tracked as CVE-2026-109618 and CVE-2026-109619, each scored 9.2 out of 10. A custom four-stage exploit, described as independently developed for the firewall platform rather than copied from a public proof of concept, ran code as the unprivileged "nobody" user on PAN-OS 12.1 and 12.2 devices. The second stage was Fragnesia, CVE-2026-46300, a high-severity Linux kernel privilege-escalation flaw in the XFRM ESP-in-TCP subsystem, scored 7.8. It turned that limited foothold into root access and a persistent root webshell. Dream puts the full chain, from unauthenticated connection to persistent root webshell, at under 15 minutes, and reports about 40 custom post-exploitation scripts and roughly 19,000 internet-facing Palo Alto firewalls fingerprinted as potential targets.

What organisations should do now

The US Cybersecurity and Infrastructure Security Agency added Fragnesia to its Known Exploited Vulnerabilities catalogue on 28 October, with a 31 October remediation deadline for covered federal civilian agencies. Palo Alto Networks said on 29 October that its PHP2Shell fixes interrupt the observed chain and that customers who applied them are not affected. Practical defences stressed in the reporting are to apply the vendor patches for all three flaws, to keep firewall management interfaces off the open internet behind a VPN or allow-list, and to capture memory forensics before rebooting any suspect appliance, since Fragnesia's in-memory technique can leave little on-disk trace. Dream also warned that a persistent tunnel into one US government-affiliated organisation was likely still running. Attribution to a suspected Chinese state-linked actor is the researchers' assessment, not a confirmed government finding, and is reported here as such.

Sources: The Register; eSecurity Planet.