Dream Research says a suspected China-nexus attacker chained PHP2Shell (CVE-2026-109618, CVE-2026-109619) with Linux kernel flaw CVE-2026-46300 (Fragnesia) through firewall management interfaces. Of about 19,000 exposed firewalls, 240 were targeted and 25 rooted in the US, Japan, Taiwan and South Korea. In a US government-affiliated network the attacker built reverse SSH tunnels, reached a central management server and went after Active Directory (LDAP service account credentials, user and group enumeration). Signs of AI-assisted tooling.
What to do: Oct 31: Vendor confirmed: the rooted firewalls are Palo Alto Networks (SecurityWeek). Same attacks failed against WordPress. JPCERT updated its PHP2Shell alert on traces of successful compromise in a firewall product. Join with evt-v-php2shell-panos.
🚨 PHP2Shell exploited in real-world attacks. An attacker chained PHP2Shell with a Linux kernel flaw to gain root access to 25 servers across four countries, including three in a U.S. government-affiliated environment. The intrusion extended into the internal
China-Linked Hackers Exploit PHP2Shell to Root Firewalls
PHP2Shellを悪用した攻撃が日本を含む4カ国に拡大。25台のサーバーがroot権限を奪取され、米政府関連組織のActive Directoryにも到達 Dream Researchによれば、攻撃者は、PHP2ShellとLinuxカーネルの権限昇格脆弱性を組み合わせ、ファイアウォールの管理インターフェースから侵入していました。 【悪用された脆弱性】 ・CVE-2026-109618 ・CVE-2026-109619 ・CVE-2026-46300（Fragnesia） 【攻撃の規模】 ・約19,000台の
PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
【更新】PHPの複数の脆弱性（PHP2Shell）に関する注意喚起を更新。あるファイアウォール製品で侵害の成功を示唆する痕跡を確認したと報告されています。引き続き、本脆弱性の対処に関しては利用製品への影響を確認し、速やかな対策と侵害調査をお願いします。^KK
Why this score
Plan rubric with caps (verified sweep, Oct 29)