Palo Alto Networks confirmed on October 29 that its Unit 42 researchers had independently verified the attacker’s tools and findings published by cybersecurity company Dream. The company urged customers to install available security fixes and remove public internet access to firewall management interfaces.
Dream identified 25 compromised firewall and management servers across the United States, Japan, Taiwan and South Korea. The tally comprised 24 firewalls and an internal management server belonging to an organisation whose infrastructure indicated an affiliation with the US government.
The organisation has not been publicly identified, and the available findings do not establish that a particular federal agency was breached. Dream described the attacker as having a Chinese nexus, rather than attributing the operation conclusively to China’s government or a named hacking group.
The intrusion exploited two critical vulnerabilities collectively known as PHP2Shell, designated CVE-2026-109618 and CVE-2026-109619, alongside a Linux kernel privilege-escalation vulnerability called Fragnesia, tracked as CVE-2026-46300.
The PHP weaknesses enabled execution of commands through vulnerable web management software without valid login credentials. The additional kernel exploit elevated those permissions to root, the highest level of control on the affected servers, allowing installation of persistent malicious access mechanisms.
Investigators traced the attacks to October 23 and 24. An automated campaign targeted 240 selected firewalls after reconnaissance identified approximately 19,000 internet-facing devices and narrowed the candidates by location and software characteristics.
One firewall associated with the government-linked environment was compromised on October 23 but subsequently crashed. The attacker successfully targeted another firewall associated with the same organisation on October 24 and used that foothold to reach systems otherwise inaccessible directly from the internet.
A persistent reverse connection provided access to internal services, including domain controllers and a central firewall management server. Within approximately 90 minutes of the second firewall compromise, the attacker exploited that management server using the same vulnerability chain.
Dream established that the intruder decrypted a directory-service account password and enumerated users and groups in the organisation’s Microsoft Active Directory environment. The attacker also attempted password spraying, creation of unauthorised accounts and extraction of authentication-related keys.
The outcomes of those additional attempts remain uncertain because the relevant results were not recovered. Investigators could not determine whether the attacker gained control of individual user accounts or successfully created backdoor identities.
Dream warned that persistent access might remain operational, although its assessment did not constitute independent confirmation that the intruder still controlled the systems. The company identified malicious web shells on other compromised firewalls without evidence of equivalent follow-on activity against those devices.
The campaign also contained indicators suggesting use of artificial intelligence tools. Investigators found Claude Code installed and an offensive security platform configured with Chinese-language models DeepSeek and Kimi. They did not establish that these tools generated the exploits or that the operation was autonomous.
Palo Alto Networks classified the PHP vulnerabilities as critical, assigning a severity score of 9.2. Its advisory identifies affected versions of PAN-OS and confirms exploitation against management interfaces exposed to the public internet.
The vendor said patched installations are not vulnerable to the observed exploit chain. It advised administrators to restrict management access to trusted internal addresses and deploy the appropriate fixed versions rather than relying exclusively on network monitoring.
The US Cybersecurity and Infrastructure Security Agency added the PHP flaws and the Linux vulnerability to its catalogue of known exploited weaknesses, requiring affected federal civilian agencies to address them under applicable deadlines.
Dream said the recovered material included 40 scripts designed for activity after the initial compromise. The tools supported internal reconnaissance, collection and attempts to expand access. Configuration information obtained from the first government-linked firewall revealed network addresses, server roles and authentication infrastructure, helping the attacker select subsequent targets. Researchers also identified private cryptographic keys taken from firewall files. However, the evidence does not establish the extent of any information removed from the environment or whether remedial containment measures have since succeeded.
Palo Alto Networks said the vulnerable component was the management web interface, including its HTTPS interface and XML API service. The company distinguished this exposure from the GlobalProtect portal, gateway and clientless VPN services, which it said were not directly affected by the PHP vulnerabilities.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
