2 publishers · first seen Wed, 28 Oct 2026 16:02 UTC · updated Thu, 29 Oct 2026 19:05 UTC
Suspected Chinese attackers exploited PHP2Shell and Fragnesia vulnerabilities to root 25 servers, including firewalls linked to U.S. government-affiliated organizations, with the first breach occurring on October 23, 2026. The attackers used a custom PHP2Shell exploit chain combined with CVE-2026-46300 to gain root access on Palo Alto Networks firewalls running PAN-OS 12.1 and 12.2, enabling them to deploy web shells and establish a persistent tunnel into internal networks. By October 24, they had compromised a second government firewall and used it to breach a third internal server, launching Active Directory attacks that included credential extraction, user enumeration, and password spraying.
The attackers leveraged AI tools including Anthropic's Claude Code, aiscan with Chinese models DeepSeek and Kimi, and FOFA API keys to identify around 19,000 exposed firewalls globally, narrowing to 240 targets in the U.S., Japan, Taiwan, and South Korea. Dream researchers confirmed the attackers developed a tailored exploit not found in public repositories, completing the full attack chain in under 15 minutes.
Content auto-generated. May contain inaccuracies.