Exploit Chain Roots Firewalls and Breaches Federal Network
Cybersecurity researchers uncover an attack chain combining remote code execution and kernel escalation to target firewalls.
- By Jesse Jacobs
- Oct 30, 2026
Cybersecurity researchers at Dream Security have detailed an attack campaign that breached 25 servers across four nations, including devices within a U.S. government-affiliated environment. The operation leveraged an exploit chain targeting internet-facing Palo Alto Networks firewalls running specific versions of the PAN-OS operating system.
The attack coupled a pair of unauthenticated remote code execution vulnerabilities known as PHP2Shell with a Linux kernel local privilege escalation flaw dubbed Fragnesia. The PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, carry Common Vulnerability Scoring System ratings of 9.2, flaws that triggered emergency patches across global web servers earlier this month. The Fragnesia vulnerability, tracked as CVE-2026-46300, holds a 7.8 rating. According to a report from The Hacker News, security analysts noted that PHP2Shell has historically seen limited practical exploitation because weaponizing it reliably requires hard-to-reproduce memory offsets from specific operating system libraries.
Investigators at Dream found that the threat actor overcame those barriers by building a custom, non-public implementation specifically calibrated for PAN-OS. The exploit targeted the session upload progress mechanism in the management web server, forcing memory exhaustion and an information leak before executing arbitrary commands under the nobody user profile. The attacker then used Fragnesia to bypass security restrictions and overwrite system authentication rules, achieving root access through a single web request without valid credentials.
The campaign used internet search engines and custom scanners to filter 19,000 exposed firewalls down to 240 vulnerable targets in the United States, Japan, Taiwan and South Korea. Automated scripts rooted 24 perimeter appliances, deploying webshells.
Activity accelerated after the adversary identified a U.S. government-affiliated organization among the compromised targets. The attacker established a persistent, reboot-surviving reverse SSH tunnel into the organization's internal network and used the same exploit chain against a central management server that controlled the entity's entire firewall fleet.
From that internal system, the actor extracted an encrypted directory service password to view Active Directory user and group records. Investigators also recorded attempts to conduct organization-wide password sprays, create backdoor domain accounts and extract security assertion markup language signing keys.
Palo Alto Networks' Unit 42 research team tracked the campaign under cluster identifier CL-UNK-1280 and confirmed the vulnerability findings. The vendor released software fixes across all affected branches to prevent further compromise.