What happened
SecurityWeek reports that Palo Alto Networks confirmed Dream Research’s findings about a campaign in which attackers chained two vulnerabilities. The first stage targeted PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 on Palo Alto Networks PAN-OS devices. The attackers then used Fragnesia, a Linux kernel privilege-escalation vulnerability, to obtain root privileges and deploy web shells. Palo Alto’s Unit 42 said it independently verified the attacker’s tooling and the reported results.
Dream had reported that at least 25 firewalls in a pool of hundreds were compromised. SecurityWeek characterizes the attackers as a China-linked group. The source describes these as confirmed compromises amid more than a week of PHP2Shell exploitation attempts, while cautioning that successful incidents remain few compared with the volume of attempts.
Palo Alto Networks released fixes for PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2, covering PA-Series and VM-Series firewalls, as well as virtual and M-Series Panorama. The company’s advisory says no special configuration is required to be affected and that active exploitation targeted management interfaces exposed to the internet. Palo Alto says those interfaces are not internet-exposed by default and urges customers to restrict access to them immediately and apply the available fixes.
The company estimated that approximately 0.02% of its global installed base had internet-facing management interfaces configured and was impacted. It said its teams had individually contacted each affected customer and would continue investigating. The source does not give a patch deadline, an affected-device count beyond the reported Dream findings, or a complete account of attacker activity after initial access.
What the archive adds
This is a new fact in a known PHP2Shell thread. CISA added Fragnesia to KEV and warned it was being chained with PHP2Shell; the present report adds Palo Alto Networks’ confirmation of the PAN-OS campaign and its fixes. A separate honeypot report quantified PHP2Shell requests but did not establish this vendor-specific patch update.
Trend signal
This supports the security implication that exposure and runtime boundaries matter more than broad vulnerability counts: an internet-facing management interface was the relevant target surface in the reported PAN-OS campaign. The closest supplied pattern is agent security moves to runtime boundaries, though this is conventional infrastructure security rather than an agent incident, so the connection is limited.
Why now
The report arrives after confirmed exploitation and Palo Alto’s release of fixes. Its practical timing is therefore operational: organizations running the listed PAN-OS versions or Panorama should check management-interface exposure and apply the fixes rather than infer safety from the small reported percentage of the global installed base.
Connections to other events
The archive’s Fragnesia KEV note describes the same exploit pairing at a broader level. The current report adds vendor confirmation and specific affected PAN-OS releases. The earlier Telegram coverage also discussed PHP2Shell’s broader exploitation activity, including the distinction between large request counts and confirmed compromises; this report brings that distinction to a concrete firewall campaign.
Why it matters
For teams operating edge appliances, a management interface is a high-consequence control plane, not an ordinary public service. The report’s key operational point is that exploitation did not require a special configuration beyond an internet-exposed management interface, and the attackers combined an application-layer flaw with a kernel privilege-escalation bug. Applying only a narrow perimeter rule or relying on a vendor’s low aggregate exposure percentage does not resolve the local risk for a device that is reachable.
The immediate response is bounded and concrete: identify PAN-OS and Panorama deployments, determine whether management interfaces are internet-facing, restrict access, and install the fixes for the listed branches. For incident responders, the confirmed chain also warrants checking for signs of web shells and unauthorized root-level activity. The source does not provide indicators of compromise or a full detection playbook, so teams should rely on the vendor advisory for those details rather than assume that patching alone determines whether a system was previously accessed.
Limits and uncertainty
The source reports Dream’s minimum of 25 compromised firewalls in a pool of hundreds, not a comprehensive victim count. Palo Alto’s approximately 0.02% figure refers to its installed base with internet-facing management interfaces that was impacted; the article does not provide the denominator or methodology. It also does not establish that every exposed device was compromised, nor does it give a full timeline, indicators of compromise, or the campaign’s complete post-exploitation scope. Broad PHP2Shell request volumes elsewhere should not be treated as equivalent to successful PAN-OS intrusions.
Reader takeaway
The meaningful unit here is not the total volume of PHP2Shell scans but the specific combination of an exposed management plane, a PAN-OS vulnerability, and a kernel escalation path. Operators should restrict management access and patch the affected branches; the reported small percentage does not answer whether an individual firewall is exposed or already compromised.