Security3 hOctober 30, 2026, 02:05

Suspected Chinese attackers used PHP2Shell to root 25 servers

Dream researchers linked suspected Chinese attackers to a campaign that since October 23 chained PHP2Shell with the Linux kernel flaw Fragnesia to gain root on 25 servers, including Palo Alto Networks firewalls tied to US government-affiliated organizations. The attackers also ran an Active Directory campaign and likely retain remote access.

The Register

Open source

Suspected Chinese attackers used PHP2Shell to root 25 servers

PHP2Shell plus Fragnesia chain reaches root in under 15 minutes
Targets span the US, Japan, Taiwan and South Korea
Attackers found about 19,000 internet-facing Palo Alto firewalls
Tools included Claude Code, DeepSeek, Kimi and FOFA

#PaloAltoNetworks#CISA#PHP2Shell#Linux

Sophos and Palo Alto retract PHP2Shell exploitation claims as attacks begin

Security

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

Security

CISA confirms PHP2Shell vulnerabilities exploited in attacks

Security

Suspected Chinese attackers used PHP2Shell to root 25 servers

Sophos and Palo Alto retract PHP2Shell exploitation claims as attacks begin

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

CISA confirms PHP2Shell vulnerabilities exploited in attacks

Palo Alto Networks: PHP2Shell flaws exploited via internet-exposed management interfaces