PHP2Shell / PAN-OS - Two PHP Memory Bugs → A Disclosure That Leaked Early → Exploits Tuned Per Firmware Version → Root in Under 15 Minutes → The Firewall Manager, Then Active Directory
PHP2Shell covers two memory-safety flaws in core PHP, CVE-2026-109618 and CVE-2026-109619, each scored 9.2 under CVSS 4.0, with affected code reaching back to PHP 5.4. Calif reported the flaw to PHP on August 11, and OpenAI and Wiz then reported the same root cause or further attack vectors. The CVE IDs began circulating on October 20, before the fixes shipped on October 21, and Amazon has traced the first exploitation attempt to October 17, four days before disclosure. Mass exploitation then ran into a practical limit: a working exploit has to fit the target's exact PHP build and configuration. As of October 28 Wordfence knew of no WordPress site compromised this way, despite more than 77,000 related requests. Appliances are the exception, because every device on a release runs the same build. On October 23 and 24 an operator used a private exploit tuned to specific PAN-OS versions, chained it with the Fragnesia Linux kernel flaw, and took root on Palo Alto Networks firewalls with internet-exposed management interfaces. Dream recovered the operator's toolkit and reports 25 systems rooted across the United States, Japan, Taiwan and South Korea, including a firewall management server in a US government-affiliated network, from which the operator reached Active Directory. Unit 42 says it independently verified the tooling and the reported results. Most of what follows in the directory has an unknown outcome, and the page says so where it applies.
Disclosure: research published by Wiz is one of the sources cited on this page, and the site's author works at Wiz. Every source is linked so you can read it directly.
📄 Dream - Chained PHP2Shell exploit roots 25 servers ↗ 📄 Unit 42 - Threat brief on PHP2Shell ↗ 📄 Palo Alto Networks - Product advisory ↗ 📄 Tenable - Why one exploit does not work everywhere ↗The target lists Dream recovered show a plain funnel. The FOFA internet search platform supplied about 19,000 internet-facing PAN-OS firewalls. A fingerprinting scanner running 200 concurrent threads got responses from about 5,000. The operator then kept devices in the United States, Japan, Taiwan and South Korea on the 12.1 and 12.2 branches, which left 240 targets.
Every one of those devices was reachable because its management interface had been exposed. Palo Alto Networks says the interface is not internet-exposed by default and puts the affected share at about 0.02% of its installed base. Dream reads the four countries as a sign of Chinese state-aligned targeting, and that reading is Dream's interpretation.
Fingerprinted: about 5,000 responded, 200 concurrent threads
Filter: US, Japan, Taiwan, South Korea; PAN-OS 12.1 and 12.2
Result: 240 targets
Palo Alto's figure: about 0.02% of its installed base internet-facing and affected
Public proofs of concept were a poor guide to this bug. PHP's security team said it identified no functional exploit at the time of release, and Tenable spent a week showing why: the memory layout an exploit relies on shifts with the PHP build, server API, extensions and runtime settings. Five deliberately vulnerable sites Tenable exposed to the internet had not been compromised as of October 29, though four of them came down on October 24, and its own working exploit needed tuning to one setup.
An appliance removes that obstacle. Dream recovered 11 JSON version profiles: two for the 11.1 branch on PHP 7.4.33 and nine for 12.1 and 12.2 on PHP 8.0.30. One of the nine had been calibrated against a running virtual machine, and the rest used offsets derived from the binary without live testing. Tenable's advice for appliances is to go by the vendor's build, since PHP version numbers do not apply.
The AI angle is narrower than the headlines. Dream found Claude Code installed in the attack infrastructure, the aiscan platform configured with DeepSeek and Kimi, and scripts whose structure suggests AI-assisted development. It also says it has no direct evidence that AI tools wrote the exploit or the post-exploitation scripts, and that the operation does not appear fully autonomous.
11.1 branch: PHP 7.4.33, 2 provisional profiles
12.1 and 12.2: PHP 8.0.30, 1 calibrated and 8 provisional
Why it worked: every device on a release shares one build, so one calibration carries over
Both flaws concern what PHP leaves behind after a fatal error. For CVE-2026-109618, PHP updates a hash table's counters before allocating the key, so an allocation that exceeds memory_limit abandons a half-built entry that shutdown cleanup still processes. CVE-2026-109619 leaves worker-wide state pointing at freed memory, which a later request on the same worker can reach. PHP processes the request before any application code runs, so application-level authentication offers no protection.
Dream describes a custom build aimed at PHP's session.upload_progress mechanism on the PAN-OS management web server: memory exhaustion, an information leak, a stale-reference setup, then a final request that yields code execution as the low-privileged nobody user. Palo Alto's advisory scopes the issue to the management web interface, meaning the HTTPS web UI and XML API, and says GlobalProtect and Captive Portal are not impacted.
Target: PAN-OS management web interface, PHP 8.0.30 on 12.1 and 12.2
Stages: memory exhaustion, information leak, stale-reference setup, code execution
Result: code execution as nobody, with no credentials
A shell as nobody on a firewall gets an attacker very little, so the operator brought a second exploit. CVE-2026-46300, known as Fragnesia, is a privilege-escalation flaw in the kernel's XFRM ESP-in-TCP code. Dream says it was used to overwrite /etc/pam.d/su to accept all authentication, after which su root succeeded without a password.
Dream says the final stage's single HTTP request carried both exploits, with no credentials, and that the chain from an unauthenticated HTTPS connection to a persistent root webshell takes under 15 minutes. A batch runner worked five targets at a time with a 30-minute timeout on each, and 24 of the 240 were rooted. CISA added Fragnesia to its Known Exploited Vulnerabilities catalog on October 28.
Method: overwrite /etc/pam.d/su so su root accepts anything
Automation: batch runner, 5 targets at a time, 1,800-second timeout
Yield: 24 of 240 firewalls rooted
The operator's next move was triage. A 103-byte PHP root webshell went to /unauth/php/change_password.php, confirmed by running id. For 22 of the 24 rooted firewalls that was all: no tunnel and no tools. Dream says they remain parked with active webshells, and that the operator could return at any time.
The first firewall in the US government-affiliated network fell at 18:14 UTC on October 23 during the batch run, crashed shortly afterwards and never came back. Hours earlier, SecurityWeek's round-up had reported no confirmed compromise from any vendor. A second firewall, whose certificate data tied it to the same organization, had only timed out in the batch. Once the first firewall's configuration suggested a government affiliation, the operator ran a dedicated campaign against the second.
Parked: 22 firewalls, webshell only
Prioritized: 2 firewalls in one US government-affiliated network
First firewall: rooted 18:14 UTC October 23, crashed, did not return
The second firewall was exploited at 10:09 UTC on October 24 and got the full treatment. Dream describes an eight-port reverse SSH tunnel to operator infrastructure, reaching domain controllers over LDAP, LDAPS and RDP, along with the firewall management server, GlobalProtect infrastructure and a SOCKS5 proxy.
A systemd service and an rc.local hook launched scripts from /usr/local/lib/.panops/, so the access survived a reboot. iox, a Chinese-developed tunneling utility, was among the recovered tools. Dream says the tunnel and webshells are likely still active and could not confirm it.
Reached: domain controllers (LDAP, LDAPS, RDP), firewall management server, SOCKS5 proxy
Boot survival: systemd service plus rc.local hook
Tooling: iox tunneling utility, about 40 post-exploitation scripts
A firewall that authenticates VPN users keeps a directory credential on the device. With root the operator had the master key, decrypted the LDAP service account password from the configuration, and hardcoded it into later scripts. Private keys for HA replication, SSL/TLS and device authentication came off the filesystem, along with the full network topology.
The haul also included a SAML IdP configuration with validate-idp-certificate: no, which Dream lists among weak security settings and does not tie to a specific device. None of this depended on PHP. A perimeter device carries the organization's trust relationships, and a rooted one hands them over.
Taken: private keys for HA replication, SSL/TLS and device authentication
Also taken: complete network topology
Weakness found: SAML IdP config with validate-idp-certificate: no
At 11:35 UTC on October 24, under 90 minutes after the second firewall, the operator exploited a central firewall management server through the tunnel. That brought the total to 25. Dream says this server manages all of the organization's firewalls and held LDAP connectivity to Active Directory because it authenticates VPN users. Dream does not name the product.
Target: central firewall management server, reached through the tunnel
Why it mattered: control over every firewall, plus LDAP connectivity to Active Directory
Dream confirms full enumeration of users and groups over LDAP. The recovered scripts went further: a password spray against all users on a domain with lockoutThreshold=0, backdoor user accounts in every OU, machine accounts through MachineAccountQuota, ACL chain analysis, SAML signing key extraction from Keycloak configuration, and probing Keycloak for an authentication bypass.
The results of those runs were not among the artifacts Dream recovered, so treat every item in that list as attempted. Dream also lists the full extent of the compromise in this environment as unknown.
Outcome unknown: password spray, backdoor users, machine accounts, SAML key extraction
Domain setting: lockoutThreshold=0, so spraying triggered no lockout
Dream's limit: attack results were not in the recovered artifacts
Amazon found the earliest attempt in its MadPot honeypots on October 17, from an address tied to a commercial anonymization network. It says it is unclear whether the attempt would have succeeded on real systems, or how the actor got exploit details early. The PHP Foundation's account of the embargo describes several breaks: the CVE IDs began circulating at about 15:00 UTC on October 20 with no technical details, Calif mistakenly published a video of its proof of concept, and Chainguard published images containing the fix at 07:41 UTC on October 21, more than six hours before the coordinated release. Amazon puts the earliest proofs of concept at around 02:00 UTC that day.
On October 24 Adel Karimi's honeypots recorded 35 successful shell executions on PHP 8.4.26 under Apache mod_php, and Karimi cautioned that this single-worker profile is not a measure of reliability on other configurations. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 26 with a federal deadline of October 29. Palo Alto Networks confirmed active exploitation of exposed management interfaces on October 29.
Several early claims did not hold. Sophos corrected a report of a successful Mirai-variant install to an attempt. Unit 42 retracted an October 23 update about an attack on a European government agency because it could not tie the initial access to these CVEs. Arctic Wolf saw PHP2Shell-themed requests that appeared to reuse older session-poisoning and deserialization tricks. The large exposure counts, 22.6 million from Cortex Xpanse and about 30.3 million from Censys, measure potentially vulnerable services, and a version match does not prove exploitability.
A separate flaw, CVE-2026-115560, had no patch when BleepingComputer reported it on October 26. It needs an unusual combination of configuration and application code, and PHP's interim mitigation is the same session.upload_progress.enabled=0 setting.
October 20: CVE IDs begin circulating, no technical details
October 21: fixes ship: 8.5.12, 8.4.27, 8.3.36, 8.2.35
October 24: 35 shell executions on honeypots
October 26: both CVEs added to CISA KEV
October 29: Palo Alto confirms active exploitation
🛡 How to Defend Against This Chain
session.upload_progress.enabled=0, memory_limit=-1 paired with a cgroup memory.max, and fatal_error_backtraces=0 where supported. Avoid RLIMIT_AS and RLIMIT_DATA, which can trigger the allocation failures the exploit depends on. All of these reduce exposure, and none replaces the fixed release.PHP_SESSION_UPLOAD_PROGRESS, and unusually large PHPSESSID cookies. These signals do not confirm exploitation on their own. The flaws can also disclose process memory without any code execution, so rotate secrets that exposed workers handled even if you find no shell./unauth/php/change_password.php and /usr/local/lib/.panops/. If you find either, assume the attacker holds the LDAP service account, the device's private keys and its configuration. Rotate those, reissue certificates, and review the directory for new users and machine accounts rather than stopping at the firewall.lockoutThreshold of zero makes spraying free, a default MachineAccountQuota lets ordinary accounts add machines, and SAML configuration that skips certificate validation weakens assertion checking. Each one helps turn a foothold on a firewall into a path to the domain. On Linux hosts you run yourself, patch the kernel too: Fragnesia is what took this chain from a low-privileged worker to root.