Patch PAN-OS now: attackers chain PHP2Shell and Linux Fragnesia to get root

Timing: PHP fixed PHP2Shell on 21 October 2026. Palo Alto Networks published its PAN-OS advisory the same day and shipped hotfixes from 25 to 29 October. CISA listed PHP2Shell in KEV on 26 October and the kernel flaw on 28 October. The kernel flaw itself was fixed in May 2026. Unit 42 confirmed the chain on 29 October. We publish on 31 October, two days later.

What happened

Attackers got root on PAN-OS firewalls whose management interface was open to the internet. They chained two bugs. PHP2Shell, CVE-2026-109618 and CVE-2026-109619, gave them code execution as a low-privileged web user. A Linux kernel flaw then raised them to root.

Dream Research found the attacker's tooling on 25 October. It says the operator rooted 25 servers in the United States, Japan, Taiwan and South Korea. Some sat in a US government-affiliated network. From there, the attacker moved on to Active Directory. Dream names the kernel flaw as Fragnesia, CVE-2026-46300.

Palo Alto Networks' Unit 42 says it independently verified the same tooling and confirmed the results. It puts the impact at about 0.02% of the installed base and says it contacted affected customers directly.

Who is affected

PA-Series, VM-Series and Panorama running a PAN-OS build without the PHP2Shell fix. The risk sits in the management web interface and XML API. A dataplane interface is exposed only if it has a management profile. Palo Alto says GlobalProtect and Captive Portal are not affected.

Palo Alto rates the flaw Critical, CVSS 4.0 score 9.2, when the interface faces the internet. It drops to 7.7 when access is limited to a jump box. Dream says the attacker built working profiles for PAN-OS 12.1 and 12.2 and tested 11.1 in a lab.

What is confirmed

• The chain. Unit 42 confirms PHP2Shell was chained with a Linux kernel privilege-escalation flaw to gain root. It confirms Dream's results.
• The kernel CVE, per CISA and Dream. Unit 42 does not name the kernel flaw. The link to CVE-2026-46300 comes from CISA's KEV entry and from Dream Research. CISA says the flaw "can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root."
• KEV dates. PHP2Shell was added on 26 October, due 29 October. CVE-2026-46300 was added on 28 October, due 31 October. Both entries are flagged for forensic triage. Ransomware use is unknown.
• The fix. Palo Alto says patched customers are not affected because the fixes break the chain. Fixed builds: 12.2.4-h1; 12.1.4-h13, 12.1.7-h11, 12.1.10-h3; 11.2.4-h23, 11.2.7-h23, 11.2.10-h16, 11.2.13-h4, 11.2.16-h1; 11.1.4-h38, 11.1.6-h40, 11.1.7-h12, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4; 10.2.7-h39, 10.2.10-h42, 10.2.13-h27, 10.2.16-h12, 10.2.18-h13. Unsupported versions must upgrade.
• The kernel flaw. Fragnesia is rated CVSS 7.8. It was disclosed with a public exploit on 13 May 2026. Upstream fixed it in 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1. Debian, Ubuntu and Red Hat shipped fixes in May.

What is not confirmed

• Palo Alto has not published a separate advisory for CVE-2026-46300 in PAN-OS. It has not said which PAN-OS builds carry the vulnerable kernel.
• Attribution is not confirmed. Dream calls it a suspected China-linked, AI-assisted operation. Unit 42 does not attribute it.
• Dream says the management web server also fronts the GlobalProtect portal. Palo Alto's advisory says GlobalProtect is not affected. We follow the vendor.
• Fragnesia matters for any Linux system, not just firewalls. We have no reports of it being used outside this chain since the KEV listing.

What to do

1. Patch PAN-OS to a fixed build above, on firewalls and Panorama. (ThreatWire advice.)
2. Take the management interface off the internet. Allow only trusted internal IPs. (Palo Alto guidance.)
3. Hunt if the interface was exposed. Look for webshells, new accounts and unexpected outbound connections. Treat a rooted device as fully compromised and contact Palo Alto support. (ThreatWire advice.)
4. Check your directory. Dream saw the attacker move from the firewall to Active Directory. Reset credentials the device could reach. (ThreatWire advice.)
5. Patch the kernel everywhere else. Update Linux servers for CVE-2026-46300 and reboot. (ThreatWire advice.)

Earlier coverage: PHP fixes PHP2Shell and CISA lists PHP2Shell as exploited.

Sources

Palo Alto Networks' advisory for CVE-2026-109618 and the Unit 42 PHP2Shell threat brief, both updated 29 October. Dream Research's report on the chained exploit. CISA's Known Exploited Vulnerabilities catalog. NVD, the Linux kernel stable tree, and the Debian, Ubuntu and Red Hat trackers for CVE-2026-46300.

Records: CVE-2026-109618, CVE-2026-109619, CVE-2026-46300