PHP2Shell and Fragnesia rooting of PAN-OS management interfaces (October 2026)

The fixed releases shipped on 2026-10-21 between 13:30 and 14:00 UTC, depending on the source, together with the technical advisories, so the earlier statement that no fix existed no longer holds (CERT-EU, 2026-10-21; ENISA, 2026-10-21; Sansec, 2026-10-21). ENISA, the European Commission, CERT-EU, Europol EC3 and the CSIRTs network advise organisations to identify their PHP-based applications, coordinate with hosting and service providers, apply the update to internet-facing systems first, and isolate exposed applications from public networks where that is not possible (ENISA, 2026-10-21). BACS published its warning the same day, telling operators to check embedded and internal PHP installations as well as public sites, to restart long-running PHP processes and rebuild containers, to verify the running version, and, where an immediate update is impossible, to consider disconnecting critical applications from the internet (BACS, 2026-10-21). BACS told RTS it knows of no reliable, confirmed substitute for the updates and that the interim measures give no guaranteed full protection (RTS, 2026-10-21).

Attack traffic was reported on the day: Cloudflare saw it against its customers while the flaws were still leaked, watchTowr's honeypots recorded exploitation, and VulnCheck's canary hosts logged scanning from 08:37 UTC and at least one unsuccessful web-shell attempt through a session file, while VulnCheck says it holds a working exploit for CVE-2026-109618 that succeeds on x86-64 with ASLR enabled; no source reports a confirmed compromise (Cloudflare, 2026-10-21; watchTowr, 2026-10-21; VulnCheck, 2026-10-21). Palo Alto Networks confirmed that every PAN-OS and Panorama release is affected through the management web interface, with no fixed release yet (Palo Alto Networks, 2026-10-21).

Public-sector sites went offline as a precaution, mostly on the evening of 2026-10-21. The canton of Basel-Stadt activated its crisis staff and shut down every PHP-run cantonal website with no restoration time given, while stating that no security-relevant incident had been registered (Canton of Basel-Stadt, 2026-10-21). The Ticino cantonal administration temporarily disabled some online services, the website of the University of Geneva was unreachable, and the EPFL site displayed a notice that its pages were currently unreachable, although nau.ch says it still worked (nau.ch, 2026-10-21); RTS lists the EPFL and University of Geneva sites as temporarily suspended (RTS, 2026-10-21). Several Neuchâtel canton and city sites were unreachable without an official statement; Arcinfo presumes a link to the PHP flaw, which the state had not confirmed (RTS, 2026-10-21). Lodur, the platform many Swiss fire brigades use to manage their fire brigades and alarm groups, was out of service because its provider took its servers offline as a precaution: users could neither read stored data nor edit alarm groups, though the Valais cantonal fire office said this does not necessarily mean the alarm-triggering systems are down (nau.ch, 2026-10-21; RTS, 2026-10-21). Publica took its website offline on the afternoon of 2026-10-21 as a precaution, says it has closed the vulnerabilities with security updates and was back online that evening, and states the outage is unrelated to the cyberattack on its software supplier (Publica, 2026-10-21). Dutch authorities took DigiD, MijnOverheid, Overheid.nl, TweedeKamer.nl and the tax authority offline for a time, and most were back by that evening (Security.nl, 2026-10-21); RTS reports that the site of the Paris police prefecture was also suspended (RTS, 2026-10-21). Basel-Stadt said it would report on progress on the morning of 2026-10-22, and no restoration status had been published as of the early morning of 2026-10-22 UTC.

BACS told Keystone-SDA and SRF on 2026-10-22 that no attack in Switzerland attributable to the two flaws is known to it, while stressing that unrecognised or unreported incidents cannot be excluded and that it has no reliable figures on affected websites, shops and internal applications (SRF, 2026-10-22; watson.ch, 2026-10-22). It also said that PHP-based applications of the federal administration were affected, that the responsible bodies were told to update, and that it has no complete overview of the update status (watson.ch, 2026-10-22; Inside IT, 2026-10-22).

The shutdowns were large and mostly short. The Basel host Cyon took all of its more than 100,000 customer websites offline for some hours and says everything has run again since the morning of 2026-10-22; the University of Geneva's site was still unreachable that afternoon, and Basel-Stadt still had pages offline at midday and says it found no data outflow (SRF, 2026-10-22). Neuchâtel disabled all PHP-based sites, ne.ch and many commune pages among them, its IT department installed the fix, and the EPFL gave its members access to its services by VPN while its site stayed down (Inside IT, 2026-10-22). Risikomonitor's live view counts 576,549 checked Swiss web servers, 540,169 already patched and 20,231 (3.5 %) still affected, with the PHP version hidden on the other 16,149 (Inside IT, 2026-10-22).

In the United Kingdom, a minister told the House of Lords on 2026-10-22 that 32 government services were unavailable and four partly unavailable, largely from precautionary measures while updates and mitigations were applied, and that the government knows of no confirmed compromise of central government systems, an assessment she extended to the wider public sector (UKAuthority, 2026-10-22; The Register, 2026-10-22). The Register adds that government sites in Germany, France, Belgium, Finland and the Netherlands were also taken offline as a precaution and that the NCSC sent 50,000 warnings (The Register, 2026-10-22).

Attack activity began before the release. Inside IT, citing a post by Cloudflare's chief executive, reports millions of attack attempts, the first at 07:43 UTC on 2026-10-21, more than six hours before the release, and relays that AWS threat intelligence recorded an exploit attempt against a honeypot on 2026-10-17 from a commercial anonymisation network, proofs of concept and attempts by several actors from 2026-10-21, and advises an operator who cannot exclude a compromise to start the investigation at least from 2026-10-17; whether the attempts would have succeeded on real systems is open (Inside IT, 2026-10-22). The Register likewise reports that AWS says attackers were exploiting the flaws four days before disclosure (The Register, 2026-10-22).

Palo Alto Networks' Unit 42 added to its brief on 2026-10-23 a report that linked an attack on a European government agency to these flaws and retracted that update on 2026-10-25; the update of 2026-10-26 below carries the retraction (Unit 42, 2026-10-25).

Other vendors report no successful exploitation. CrowdStrike has not observed any in the wild or in its honeypots and expects a reliable exploit only against a specific deployment profile, such as a fixed Docker image (CrowdStrike, 2026-10-23); Wordfence knows of no compromise among the more than 74,000 attempts its firewall intercepted (Wordfence, 2026-10-22); and Sophos corrected on 2026-10-22 its earlier report of successful exploitation to scanning and a small number of failed attempts, one of them a blocked attempt to deliver a likely Mirai-derived botnet variant (Sophos, 2026-10-22). VulnCheck's exploit now covers PHP 8.4.10 to 8.4.26 and 8.5.10 and 8.5.11 on AMD64 and ARM64 with default settings and display_errors off under mod_php, and WordPress on default Docker installs, as of 5:30 PM ET on 2026-10-23 (VulnCheck, 2026-10-21). Neither flaw is in CISA's KEV catalog as of version 2026.10.23 (CISA KEV, 2026-10-23).

PHP posted an informational advisory on 2026-10-23 for a third code-execution path, CVE-2026-115560, that the October releases do not fix: it needs an application that sets session.serialize_handler to php_binary or php_serialize, switches it to php with ini_set() before session_start(), and leaves session upload progress enabled (PHP, 2026-10-23). PHP calls it an unlikely vector, issues no emergency release, suggests session.upload_progress.enabled=0 until the next regular bugfix release, says a host that applied that setting from the 2026-10-21 advisory should keep it, and will publish the full advisory with the next release (PHP, 2026-10-23). PHP has not stated affected versions or a severity score, and no exploitation is reported (The Hacker News, 2026-10-23).

Vendor statuses moved. Cisco's advisory, revised on 2026-10-23, now describes a workaround for Expressway in its bug record, keeps the fixed release 15.5.21 undated, lists Ultra-Reliable Wireless Backhaul with a fix in 27.1.1 (February 2027), exploitable there only by an authenticated administrator and with a workaround described, and lists Duo Access Gateway with fixed release 3.2.0 (Cisco PSIRT, 2026-10-23). Splunk now lists only Smartlook as under investigation (Splunk, 2026-10-23). Palo Alto Networks' advisory now lists WF-500 and WF-500-B as unaffected, a correction its timeline dates 2026-10-23, its table no longer distinguishes Panorama, and a note says the issue applies to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama; the PAN-OS hotfix dates of 2026-10-26 to 2026-10-30 are unchanged (Palo Alto Networks, 2026-10-24).

Tenable's Security Center (versions 6.6.0, 6.7.2, 6.8.0 and 6.9.1) and Enclave Security (1.7.0, 1.8.0 and 1.9.1) bundle PHP, and patch SC-202610.2 updates the bundled PHP to 8.2.35 (Tenable, 2026-10-23; Tenable, 2026-10-23). Siemens lists RUGGEDCOM APE1808 application-hosting devices running Palo Alto Networks PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 as affected by the two flaws and gives patch and update information only through customer support (Siemens ProductCERT, 2026-10-23).

ReliaQuest says it independently reproduced exploitation of CVE-2026-109618 in controlled labs, with code execution only where the exploit's prerequisites were already present, and that it has not observed successful exploitation in customer environments (ReliaQuest, 2026-10-22). The sequence it saw in its logs is a POST that returns HTTP 500, PHP memory exhaustion reported "in Unknown on line 0", heap corruption and an abort of the Apache worker that handled the request within seconds, which it reads as a stronger indication when the events involve the same process (ReliaQuest, 2026-10-22).

Palo Alto Networks' Unit 42 retracted on 2026-10-25 the update of 2026-10-23 in which it had reported post-exploitation by agentic attack platforms at a European government entity. Its brief now says that what its researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application, that this led them to believe it was exploitation of these flaws, and that it is unable to confirm that the initial access is associated with the specific PHP2Shell CVEs (Unit 42, 2026-10-25). The observations of the retracted update, including the command-batch markers and the Active Directory activity, are no longer part of the brief. The brief still recommends assessing exposure and patching immediately (Unit 42, 2026-10-25).

What remains documented is scanning and attack attempts, reported by Cloudflare, watchTowr, VulnCheck and others, and VulnCheck's working exploit for specific PHP builds; CrowdStrike, Sophos and Wordfence report no successful exploitation, and no source tied a named CVE to a production compromise. The Hacker News article of 2026-10-25 relays the retracted account and carries no correction (The Hacker News, 2026-10-25).

CISA added both flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26 and updated its alert the same day, which still tells operators to patch internet-facing systems first, to take PHP-based systems offline where they cannot be patched or run PHP 8.1 or earlier, and to monitor for PHP worker processes launching shells or downloading tools (CISA, 2026-10-26; CISA KEV, 2026-10-26). The listing follows a honeypot report by Adel Karimi of Perplexity dated 2026-10-24, relayed by SecurityWeek and BleepingComputer on 2026-10-26, that documents the first successful code execution: 35 execution-stage requests against three honeypots running PHP 8.4.26 under single-worker mod_php, each followed by a shell started directly by an Apache worker, consistent with CVE-2026-109618 and not establishing a separate CVE-2026-109619 path (Karimi, 2026-10-24; SecurityWeek, 2026-10-26; BleepingComputer, 2026-10-26). It is honeypot evidence: no second-stage download was observed, Karimi says it does not measure exploit reliability on other worker counts, PHP builds or applications, and, as of 2026-10-27, no source ties a named CVE to a production compromise; Unit 42's retraction of 2026-10-25 stands. Expel's Marcus Hutchins calls it by far the highest-quality confirmation of in-the-wild exploitation he has seen (BleepingComputer, 2026-10-26).

VulnCheck's page, updated as of 2026-10-26, extends its working exploit to mod_php on PHP 8.2.28 to 8.2.34 and 8.3.22 to 8.3.35 as well as 8.4.10 to 8.4.26 and 8.5.10 to 8.5.11 (VulnCheck, 2026-10-26). In Switzerland, SRF reports on 2026-10-26 that TCS Camping is warning about 15,000 customers because data was stolen at its booking-system supplier Camping.Care in connection with the PHP flaw: names, telephone numbers and reservation numbers were used in fraudulent WhatsApp messages, and TCS says account and IBAN data were not affected; neither SRF nor TCS names a CVE or the entry point (SRF, 2026-10-26).

Palo Alto Networks' advisory for both flaws now states that active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet, and its severity is Critical with urgency Highest (Palo Alto Networks, 2026-10-28). A copy of the page taken on 2026-10-27 at 17:10 UTC said instead that very limited exploitation had been observed (Palo Alto Networks, 2026-10-27). The advisory names no victim, actor or post-exploitation behaviour and does not say which flaw was used. It is a vendor statement about its own product, Unit 42's retraction of 2026-10-25 stands (Palo Alto Networks Unit 42, 2026-10-25), and Palo Alto's remaining PAN-OS hotfixes are due by 2026-10-30 (Palo Alto Networks, 2026-10-28).

CISA's catalog entry of 2026-10-28 for the Linux kernel flaw CVE-2026-46300 says it can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root (CISA KEV, 2026-10-28). Dream Research reports a chain that takes these flaws to root on appliances: a custom, non-public PHP2Shell build for the management web server of one large vendor's firewall software, which runs PHP 8.0.30 with a high memory limit, gave code execution as the nobody user, and the kernel flaw lifted it to root in one HTTP request in under 15 minutes (Dream Research, 2026-10-27). Dream found the build tuned to eleven firmware versions, nine exploitable, with offsets from the vendor's own PHP library, the deployment-specific calibration CrowdStrike expects a reliable exploit to need (an inference) (Dream Research, 2026-10-27; CrowdStrike, 2026-10-23). From about 19,000 internet-facing firewalls of that vendor it narrowed to 240, rooted 24 and left a PHP webshell on each, and from the second of two firewalls of a US government-affiliated organization (the first crashed) built a persistent outbound SSH tunnel, rooted the organization's firewall management server through it and began an attack on its Active Directory; Dream could not tell whether that attack succeeded, does not name the vendor, calls the campaign apparently Chinese and AI-assisted and does not attribute it to a named actor (Dream Research, 2026-10-27). The targets were firewalls whose management interfaces were reachable from the internet (Dream Research, 2026-10-27).

Palo Alto Networks' advisory as read on 2026-10-29 lists all PAN-OS hotfixes as released except 11.1.7-h12, due on 2026-10-30 (Palo Alto Networks, 2026-10-29).

GreyNoise's live tracker, last updated 2026-11-01 03:48 UTC, records successful exploitation on its deliberately vulnerable sensors from 2026-10-28, the first when an Apache worker spawned a shell that ran curl, and counts 1,177 confirmed exploitations from five attacker addresses, defined as sessions in which the web server ran operating-system commands (GreyNoise, 2026-11-01). The count is of shell events on sensors, not of compromised servers. The commands recorded on 2026-10-29 include bash reverse shells over /dev/tcp, creation of /var/www/.ssh, queries to the cloud metadata address and downloads of the linPEAS and gitleaks enumeration and secret-scanning tools; secret-scanning runs over /var/www/html and system directories appear in the sessions of 2026-10-31 (GreyNoise, 2026-11-01).

Hunt.io, reading open-directory captures, says shells have been confirmed only on honeypots and sensors, which it names as watchTowr, 0x4D31 and GreyNoise, and that its shared exploit kit has not been seen landing on a live victim, while relaying Dream Research's and Unit 42's account of PAN-OS firewalls rooted in production as the first confirmed production compromises; in one capture an operator who ran the chain against a national government got only a crash, because session files lay outside the webroot, and then broke in with a different bug (Hunt.io, 2026-10-28).

Dream Research updated its report on 2026-10-29 to say that the affected devices run Palo Alto Networks PAN-OS and that the operation rooted 25 PAN-OS firewall and management servers, and Unit 42 says it independently verified the attacker's tooling and confirmed the reported results (Dream Research, 2026-10-29; Unit 42, 2026-10-29). The earlier description of "one unnamed vendor" above is superseded.

Palo Alto Networks revised its advisory on 2026-10-23: the WildFire appliances WF-500 and WF-500-B are now listed as affected in all versions, and the footnotes say Cortex XCORE (SaaS) was remediated on 2026-10-21 and WildFire Cloud on 2026-10-22 (Palo Alto Networks, 2026-10-23). The advisory now also gives estimated availability dates for hotfix builds of every supported PAN-OS train, from 2026-10-26 (for example 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16) to 2026-10-30, while Panorama and the WildFire appliances remain with no date (Palo Alto Networks, 2026-10-23). Palo Alto still states that it is not aware of malicious exploitation against its products, and the Threat Prevention coverage and the jump-box restriction are unchanged (Palo Alto Networks, 2026-10-23). The advisory names the management web interface only for PAN-OS and does not say which interface of the WildFire appliances is reachable.

Palo Alto Networks' advisory now lists the WildFire appliances WF-500 and WF-500-B, which an earlier revision of 2026-10-23 had listed as affected, as unaffected, a correction its timeline dates 2026-10-23, and the table no longer distinguishes Panorama while a note says the issue applies to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series) and the mitigation text covers PAN-OS and Panorama together (Palo Alto Networks, 2026-10-24). The estimated hotfix dates for PAN-OS, 2026-10-26 to 2026-10-30, the CVSS-B scores of 8.7 and 7.1, and the statement that Palo Alto Networks is not aware of malicious exploitation against its products are unchanged; on 2026-10-24 the advisory added updated threat-signature and content-version details, and the Threat Prevention coverage now lists twenty further Threat IDs, from 97643 to 97678 (Palo Alto Networks, 2026-10-24).

Palo Alto Networks' revision of 2026-10-25 removed the estimated dates of 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 "as these versions are released" (Palo Alto Networks, 2026-10-25); the advisory's solution text, unrevised, still says the issue will be fixed in upcoming releases of PAN-OS, and every other hotfix carries an estimated date from 2026-10-27 to 2026-10-30 (Palo Alto Networks, 2026-10-25). The FAQ adds that Palo Alto's current analysis shows no impact on PAN-OS firewalls or Panorama of CVE-2026-115560, the new vulnerability PHP announced, and Palo Alto still knows of no malicious exploitation against its products (Palo Alto Networks, 2026-10-25).

Palo Alto Networks' advisory now records eleven PAN-OS hotfixes as released: 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 (revision of 2026-10-25), 11.1.4-h38, 11.1.6-h40, 11.1.10-h36 and 11.1.13-h16 (2026-10-26), and 10.2.13-h27, 10.2.16-h12, 12.1.7-h11 and 12.2.4-h1 (2026-10-27) (Palo Alto Networks, 2026-10-27). Nine hotfixes still carry estimated dates from 2026-10-27 to 2026-10-30, among them 12.1.4-h13, 12.1.10-h3 and four 11.2 lines, and the FAQ says 11.2.10-h16 carries only the PHP fix while 11.2.10-h17 carries the PHP and the Brotli fixes (Palo Alto Networks, 2026-10-27). Palo Alto still says it is not aware of malicious exploitation of this issue against its products (Palo Alto Networks, 2026-10-27). CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26, as the PHP flaws themselves rather than as a PAN-OS finding (CISA KEV, 2026-10-26).

Palo Alto Networks' advisory now states that active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet (Palo Alto Networks, 2026-10-28). A copy of the page taken on 2026-10-27 at 17:10 UTC said instead that very limited exploitation had been observed (Palo Alto Networks, 2026-10-27); the vendor timeline records no change of wording, and its entries of 2026-10-27 are two removals of hotfix estimated dates and the 16:40 UTC change that raised the severity to Critical and the urgency to Highest (Palo Alto Networks, 2026-10-28). The vendor score is now CVSS-B 9.2 with high impact on confidentiality, integrity and availability when management is reachable from the internet, and 7.7 when it is reachable only from an adjacent network; the earlier text scored availability impact only (8.7) and knew of no exploitation. The advisory names no actor, victim or post-exploitation behaviour. CISA's catalog flags both PHP flaws with forensic triage requirements (CISA KEV, 2026-10-27). The hotfix table has moved on since the previous record: as read on 2026-10-28, fourteen builds are released and six are due by 2026-10-30 (Palo Alto Networks, 2026-10-28).

Palo Alto Networks' advisory timeline of 2026-10-29 removes the estimated dates of 10.2.7-h39, 10.2.10-h42, 11.2.4-h23, 12.1.4-h13 and 12.1.10-h3 because those builds are released (Palo Alto Networks, 2026-10-29). Nineteen of the twenty hotfixes are now available, and the advisory table gives only 11.1.7-h12 an estimated date, 2026-10-30 (Palo Alto Networks, 2026-10-29). Its exploitation statement is unchanged.

Palo Alto Networks' advisory timeline of 2026-10-29 at 23:54 UTC removes the estimated date of 11.1.7-h12 "as the version is released" (Palo Alto Networks, 2026-10-30). With it, all twenty PAN-OS hotfixes are available and the advisory table gives no estimated date for any build (Palo Alto Networks, 2026-10-30). The exploitation statement is unchanged.

Dream Research updated its report on 2026-10-29 to say that the affected devices run Palo Alto Networks PAN-OS; the operation it had described with an unnamed vendor rooted 25 PAN-OS firewall and management servers, and Unit 42 says it independently verified the attacker's tooling and confirmed the reported results (Dream Research, 2026-10-29; Unit 42, 2026-10-29). Dream's recovered artifacts show web shells left on 24 firewalls, 22 of them parked with nothing further done, and a boot-persistent tunnel into the internal network of a US government-affiliated organization that it assesses is likely still active (Dream Research, 2026-10-29). Unit 42 says customers who applied the available patches are not affected and that the management interface is not exposed to the internet by default (Unit 42, 2026-10-29). Dream also says the management web server fronts the GlobalProtect portal, which Palo Alto's advisory lists as not affected (Dream Research, 2026-10-29; Palo Alto Networks, 2026-10-30). A device that was exposed and unpatched therefore needs the compromise checks in the Detection line, not only the hotfix.

Red Hat rates CVE-2026-46300 CVSS 7.8 (Red Hat Product Security, 2026-05-13). Red Hat's own security bulletin groups it under the collective "Dirty Frag" name alongside CVE-2026-43284 and CVE-2026-43500, labelling it specifically "Fragnesia (skb coalescing via ESP-in-TCP)": "three vulnerabilities, collectively known as 'Dirty Frag', have been identified in networking subsystems of the Linux kernel, two of which affect Red Hat products" (Red Hat RHSB-2026-003, 2026-07-03). Applicability splits per CVE: "Red Hat says CVE-2026-43500 doesn't affect its products, while CVE-2026-43284 and CVE-2026-46300 do affect supported Red Hat Enterprise Linux kernels and anything built on them" (Aikido Security, 2026-09-04). Any RHEL, OpenShift or RHEL CoreOS estate must therefore confirm the CVE-2026-46300 fix specifically, not only the earlier two. For the Dirty Frag family as a whole (CVE-2026-43284, CVE-2026-43500 and CVE-2026-46300), Aikido writes: "Researchers have already published working proof-of-concept exploits for Kubernetes, and Ubuntu spells out the risk of a container escape"; it names no Kubernetes exploit for CVE-2026-46300 itself (Aikido Security, 2026-09-04). Because containers share the host kernel, a compromised workload that can reach the vulnerable code path (governed by seccomp, pod security and user-namespace settings) can escalate to root on the node (Aikido Security, 2026-09-04). As of 2026-09-05, no source stated confirmed in-the-wild exploitation of this specific CVE. Microsoft's previously reported limited in-the-wild activity ("privilege escalation involving 'su'") was itself stated as ambiguous between the "Dirty Frag" family and the separate, earlier "Copy Fail" vulnerability (CVE-2026-31431) (Microsoft Security Blog, 2026-05-08). That is not a distinction between the two Dirty Frag CVEs themselves, and not specific evidence of exploitation for CVE-2026-46300.

CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog on 2026-10-28 and says in the entry that the flaw can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root, naming no actor or victim (CISA KEV, 2026-10-28). Dream Research describes a chain of this kind from artifacts its tooling recovered: a custom, non-public PHP2Shell build, tailored to the management web server of one large vendor's firewall software that runs PHP 8.0.30, gives code execution as the nobody user, and the Fragnesia exploit then overwrites /etc/pam.d/su in the page cache so that su root succeeds without a password; Dream says SELinux confines the web server's domain from modifying system files and that the whole chain runs in one HTTP request in under 15 minutes (Dream Research, 2026-10-27). From about 19,000 internet-facing firewalls of that vendor that it found through a search engine, the attacker narrowed to 240 in the United States, Japan, Taiwan and South Korea, rooted 24 and planted a PHP webshell on each; on the second of two firewalls of a US government-affiliated organization (the first crashed) it set up an outbound SSH tunnel kept up by a systemd service and an rc.local entry, rooted the organization's firewall management server through the tunnel, decrypted the LDAP service-account password with root access and sprayed passwords against a domain that had no lockout threshold (Dream Research, 2026-10-27). Dream could not tell whether any of the Active Directory attacks succeeded, does not name the vendor, calls the campaign apparently Chinese and AI-assisted and does not attribute it to a named actor (Dream Research, 2026-10-27).