Chinese Hackers Weaponize PHP2SHELL to Breach US Firewalls

From theoretical risk to active root compromise

When PHP2SHELL surfaced earlier this month, the initial fallout was strange. Panic gripped the security industry because PHP runs roughly 70 percent of the web, yet millions of automated scan attempts repeatedly failed to produce verified breaches. Defensive mitigations like Address Space Layout Randomization (ASLR) made the bug notoriously finicky to exploit reliably in the wild.

That temporary reprieve has evaporated. Cybersecurity firm Dream revealed that a sophisticated Chinese threat actor managed to turn the flaw into a reliable weapon. By combining the PHP2SHELL exploit with Fragnesia (CVE-2026-46300)—a local privilege-escalation bug disclosed in May—the attackers bypassed memory protections, escalated privileges to root, and seized complete control of target appliances.

Fifteen minutes from exposed HTTPS to Active Directory

The attack campaign began around October 23, 2026, targeting systems across the United States, Japan, Taiwan, and South Korea. The operators focused heavily on legacy Palo Alto Networks hardware running unpatched PAN-OS releases, targeting management interfaces left openly accessible to the public internet.

Once a target was selected, lateral movement unfolded at alarming speed. According to Dream's forensic data, the entire intrusion chain—from an unauthenticated web request to planting persistent root webshells—took less than 15 minutes. The operators ran 40 custom post-exploitation scripts, tunneled deeper into internal corporate subnets, hit secondary servers, and began pillaging Active Directory environments before defensive teams could intervene.

While perimeter appliances frequently serve as enterprise footholds, as seen when corporate CCTV software exposed corporate networks, finding critical firewall management consoles exposed to the open web remains an astonishing operational lapse.

Tooling: AI assistance and search-engine recon

Forensic artifacts left behind paint a clear picture of the operators' workflow. The intrusion was not an autonomous cyberattack run by bots, but a disciplined manual effort backed by cutting-edge offensive tooling. Researchers recovered installations of Claude Code alongside AIscan, a specialized offensive security suite configured with Chinese large language models DeepSeek and Kimi.

Target discovery was similarly deliberate. Attackers relied on API access to FOFA, a Chinese network mapping search engine akin to Shodan, identifying approximately 19,000 internet-facing Palo Alto Networks firewalls worldwide. Security analysts caution that because persistent backdoors were installed on target machines, the threat group likely retains access to several compromised government-affiliated environments.

What enterprise administrators need to do

Any organization operating Palo Alto Networks perimeter equipment in the US, Europe, or Asia must audit management interfaces immediately. Under no circumstances should PAN-OS administrative web ports be exposed directly to the public internet without an isolated out-of-band management network or trusted VPN wrapper.

Organizations should verify that appliances are running fully patched firmware that resolves both the underlying PHP vulnerabilities and the Fragnesia Linux kernel bug. If exposed devices were unpatched between October 23 and today, assume compromise, isolate the hardware, and inspect Active Directory logs for unexpected authentication attempts.