Chinese hackers breach US government firewalls using custom PHP2Shell exploit chain

Cybersecurity firm Dream reports that suspected Chinese threat actors compromised 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated entities. The intrusions began on October 23, 2026, probing systems in the US, Japan, Taiwan, and South Korea before focusing on devices running vulnerable versions of PAN-OS, specifically versions 12.1 and 12.2. Palo Alto Networks' Unit 42 research team independently verified the findings and the tooling used in the attacks. [1][3]

The attackers created an independently developed, four-stage exploit combining PHP2Shell vulnerabilities with Fragnesia, a Linux kernel privilege-escalation flaw tracked as CVE-2026-46300. The full intrusion chain takes under 15 minutes, moving from an unauthenticated HTTPS request sent to an exposed management interface to deploying a persistent root web shell. Once inside, the operators ran about 40 custom post-exploitation scripts to tunnel into internal networks, compromise additional servers, and execute Active Directory attacks, including password spraying and attempting SAML key extraction. [1][3]

Dream observed that while the campaign was not fully automated, the intruders relied on tools including Anthropic's Claude Code, the AI security platform aiscan configured with Chinese models DeepSeek and Kimi, and the Chinese search engine FOFA. The group used FOFA API keys to identify roughly 19,000 exposed Palo Alto Networks firewalls worldwide. Researchers warn that the threat actors likely retain persistent remote access to affected networks, including an active tunnel inside a compromised US government-affiliated organization. [1][3]