Changed since version 2

• Title, verdict and triage now lead with Palo Alto's confirmation of active exploitation against internet-exposed PAN-OS management interfaces, with fixes released [S1].
• Scope adds the affected and fixed PAN-OS versions, the management-exposure condition, and the GlobalProtect / Clientless VPN exclusion. The 'undisclosed vendor' line is replaced [S1].
• Credential extraction and AD enumeration are upgraded from unconfirmed to confirmed in recovered artifacts. Account creation remains unconfirmed [S1][S5].
• Fragnesia CVE-2026-46300 KEV listing is now cited to CISA reporting [S6].
• Removed the claim that a public PoC exists [S6]: no numbered source supports it. It is moved to open_questions.
• Source numbering re-mapped: the Dream campaign report is now [S5], the CISA Fragnesia report is [S6], and the PAN report is [S1].
• Hunts rewritten to use index=*. Added hunts for root shells from PHP, new web-root PHP files and outbound appliance SSH [S5][S6].
• Confidence set to medium: vendor and CISA statements are reached only via secondary reporting.

What happened

• Palo Alto Networks updated its advisory: active exploitation of the PHP2Shell flaws has been observed against PAN-OS management web UI and XML API exposed to the internet. Fixes are released [S1].
• CISA added Fragnesia (CVE-2026-46300) to KEV. It warned the flaw can be chained with CVE-2026-109618/109619 to implant PHP web shells and run commands as root [S6].
• Dream reports a suspected China-nexus actor rooted 25 devices across the US, Japan, Taiwan and South Korea. The actor then tunnelled by reverse SSH into a US government-affiliated network [S5][S6].
• Recovered artifacts confirm credential extraction and AD enumeration [S1]. Backdoor AD account creation was attempted. Its success is unconfirmed [S5].
• CISA listed CVE-2026-109618/109619 in KEV. Amazon reports targeting began four days before PHP's October 21 patches [S4].
• CVE-2026-115560 is a separate PHP RCE. It has a mitigation only (session.upload_progress.enabled=0) and affects a non-default configuration [S2][S3].

Timeline

Detect

php_parent_spawns_root_shell · Linux process telemetry (EDR / auditd / Sysmon for Linux)

index=* (parent_process_name="php*" OR parent_process_name="httpd" OR parent_process_name="apache2" OR parent_process_name="appweb*") (process_name="sh" OR process_name="bash" OR process_name="dash" OR process_name="curl" OR process_name="wget" OR process_name="python*" OR process_name="ssh") | stats count min(_time) as first_seen values(process) as commands values(user) as users by dest parent_process_name process_name | sort - first_seen

FROM logs-* | WHERE (process.parent.name LIKE "php*" OR process.parent.name IN ("httpd", "apache2") OR process.parent.name LIKE "appweb*") AND (process.name IN ("sh", "bash", "dash", "curl", "wget", "ssh") OR process.name LIKE "python*") | STATS count = COUNT(*), first_seen = MIN(@timestamp), commands = VALUES(process.command_line), users = VALUES(user.name) BY host.name, process.parent.name, process.name | SORT first_seen DESC

A hit means: A PHP or web-server process started a shell or network tool. This matches web-shell command execution. A hit with user=root fits the reported PHP2Shell + Fragnesia chain [S6][S1].

new_php_file_in_web_root · File integrity / EDR file-creation events on web servers and appliances

index=* (file_name="*.php" OR file_name="*.phtml") (action=created OR action=modified) | stats count min(_time) as first_seen values(file_path) as paths values(user) as users by dest | sort - first_seen

FROM logs-* | WHERE (file.name LIKE "*.php" OR file.name LIKE "*.phtml") AND event.action IN ("created", "modified", "creation", "modification") | STATS count = COUNT(*), first_seen = MIN(@timestamp), paths = VALUES(file.path), users = VALUES(user.name) BY host.name | SORT first_seen DESC

A hit means: A new or changed PHP file in a publicly reachable directory matches the actor's web-shell persistence [S5][S1]. Correlate with deployments before escalating.

outbound_ssh_from_internal_appliance · Firewall / NetFlow connection logs

index=* dest_port=22 | where (cidrmatch("10.0.0.0/8",src_ip) OR cidrmatch("172.16.0.0/12",src_ip) OR cidrmatch("192.168.0.0/16",src_ip)) AND NOT (cidrmatch("10.0.0.0/8",dest_ip) OR cidrmatch("172.16.0.0/12",dest_ip) OR cidrmatch("192.168.0.0/16",dest_ip)) | stats count sum(bytes_out) as bytes_out min(_time) as first_seen values(dest_ip) as destinations by src_ip | sort - first_seen

A hit means: Outbound SSH to the internet. When src_ip is a firewall or management appliance, this matches the actor's reverse SSH tunnel [S5]. Filter results to appliance management IPs.

ad_spray_then_account_creation · Windows Security event log on domain controllers

index=* (EventCode=4625 OR EventCode=4720) | eval spray_user=if(EventCode=4625,TargetUserName,null()), spray_src=if(EventCode=4625,src_ip,null()), fail_t=if(EventCode=4625,_time,null()), new_acct=if(EventCode=4720,TargetUserName,null()), create_t=if(EventCode=4720,_time,null()) | stats dc(spray_user) as sprayed_users values(spray_src) as spray_sources min(fail_t) as first_fail values(new_acct) as created_accounts min(create_t) as first_create by Computer | where sprayed_users>=20 AND first_create>first_fail AND first_create-first_fail<86400 | sort - first_create

FROM logs-* | WHERE event.code IN ("4625", "4720") | EVAL spray_user = CASE(event.code == "4625", user.target.name, NULL), spray_src = CASE(event.code == "4625", source.ip, NULL), fail_t = CASE(event.code == "4625", @timestamp, NULL), new_acct = CASE(event.code == "4720", user.target.name, NULL), create_t = CASE(event.code == "4720", @timestamp, NULL) | STATS sprayed_users = COUNT_DISTINCT(spray_user), spray_sources = VALUES(spray_src), first_fail = MIN(fail_t), created_accounts = VALUES(new_acct), first_create = MIN(create_t) BY host.name | WHERE sprayed_users >= 20 AND first_create > first_fail AND DATE_DIFF("second", first_fail, first_create) < 86400 | SORT first_create DESC

A hit means: Failed logons across many users, followed by a new account on the same DC within a day. This matches the actor's tunnelled spray and attempted backdoor accounts [S5]. Escalate when a spray source is a firewall or management-appliance IP.

Verify

• Check PAN-OS management access logs for web UI or XML API requests from unexpected internet IPs before the fix date [S1].
• Spray sources that are firewall or management-appliance IPs are the strong signal. These devices should not authenticate to a DC [S5].
• Tie the chain together on one host: a new PHP file in the web root, a shell from the PHP process, and outbound SSH in the same window [S5][S6].
• Match created AD accounts against change tickets and provisioning records.
• Benign look-alikes: deployment tooling writes PHP files, and admin cron jobs or PHP-FPM exec calls spawn shells. Vulnerability scanners and misconfigured service accounts produce 4625 bursts. Routine provisioning produces 4720. Admin backups use SSH.

Scope

Affected

• PAN-OS 12.2 < 12.2.4-h1; 12.1 < 12.1.4-h13 / 12.1.7-h11 / 12.1.10-h3 [S1]
• PAN-OS 11.2 < 11.2.4-h23 / 11.2.7-h23 / 11.2.10-h16 / 11.2.13-h4 / 11.2.16-h1 [S1]
• PAN-OS 11.1 < 11.1.4-h38 / 11.1.6-h40 / 11.1.7-h12 / 11.1.10-h36 / 11.1.13-h16 / 11.1.16-h4 [S1]
• PAN-OS 10.2 < 10.2.7-h39 / 10.2.10-h42 / 10.2.13-h27 / 10.2.16-h12 / 10.2.18-h13 [S1]
• PHP deployments not on the fixed releases for CVE-2026-109618/109619 [S4]
• Linux kernels vulnerable to Fragnesia CVE-2026-46300 (XFRM ESP-in-TCP) [S6]
• PHP apps using a php_binary/php_serialize serialize_handler, an ini_set switch to php before session_start(), and upload progress enabled (CVE-2026-115560) [S2]

Only if

• PAN-OS management web UI or XML API is reachable from the internet [S1]
• PAN-OS dataplane interface only if a management profile is attached to it [S1]
• session.upload_progress is reachable on the PHP target [S5][S2]

Not affected if

• PAN-OS management interface is not exposed to the public internet [S1]
• GlobalProtect portal, gateway and Clientless VPN are not impacted [S1]

Fixed in: PAN-OS hotfixes as listed (e.g. 12.2.4-h1, 11.2.16-h1, 11.1.16-h4, 10.2.18-h13) [S1]. PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 for PHP2Shell; EOL ≤8.1 gets no PHP fix. CVE-2026-115560: mitigation only [S2]. No kernel fix version for CVE-2026-46300 is given in the sources.

Enumerate

• PAN-OS devices: version, hotfix level, and management web UI / XML API exposure, including management profiles on dataplane interfaces
• Other firewall or appliance management servers running PHP
• PHP versions across the estate, including EOL ≤8.1 installs
• Linux kernel versions exposed to CVE-2026-46300
• PHP apps with the CVE-2026-115560 configuration pattern
• Service accounts whose credentials are stored on firewalls or management servers, and AD accounts created since 2026-10-17

Contain

• Preserve appliance logs, web roots and, where possible, memory or a tech-support file first.
• Remove internet access to PAN-OS and other firewall management interfaces, and restrict them to trusted internal IPs [S1].
• Block outbound SSH from firewall and appliance networks except to known-good destinations [S5].
• Set session.upload_progress.enabled=0 on exposed PHP where feasible. This is PHP's mitigation for CVE-2026-115560 [S2].
• Rotate LDAP and other service-account credentials stored on any exposed appliance, because credential extraction is confirmed in the campaign [S1]. Rotation cannot be undone, so capture evidence first.
• Disable unapproved AD accounts created since the campaign window. Keep them disabled rather than deleted, so they remain available as evidence.

Eradicate

• Remove PHP web shells from publicly accessible directories on appliances and web servers [S5][S6].
• Tear down reverse SSH tunnels and any associated persistence [S5].
• Apply PAN-OS hotfixes, PHP fixes and kernel patches. Treat rooted devices as untrusted until they are reimaged or rebuilt per vendor guidance [S1][S6].

Recover

• Before returning a device to service, confirm it runs a fixed PAN-OS hotfix or PHP release and a patched kernel, and that its management interface is not internet-reachable [S1].
• Validate AD: no unapproved accounts, rotated service-account credentials, and no ongoing enumeration.
• Afterwards, monitor for appliance-originated AD authentication, outbound SSH from appliances, web-root file changes and shells spawned by PHP.

Re-enter the loop when

• Palo Alto Networks revises affected versions, adds products, or publishes IoCs.
• Another firewall or OT vendor confirms PHP2Shell exploitation in its products.
• A kernel fix version or distro advisory for CVE-2026-46300 is published.
• CVE-2026-115560 is confirmed exploited, receives a patch, or is added to KEV.
• Dream or CISA publishes IoCs, or reports successful AD account creation.

Debrief

• Record PAN-OS and appliance exposure at the time of disclosure, patch dates against the KEV listing dates, any web-shell paths, tunnel endpoints, AD spraying and the timing of credential rotation.
• Gaps in the sources: no primary PAN advisory or CISA URL is in the sources; no IoCs are given; no Fragnesia kernel fix version is given; success of AD account creation is unconfirmed [S5][S1].

Detection coverage — checked automatically

Checked automatically 2026-11-10 05:36Z from public sources: 37 published, 8 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2026-46300 — CISA adds Fragnesia Linux kernel flaw (CVE-2026-46300) to KEV; attackers reportedly chain it with PHP2Shell to root serv; CVE-2026-109618 — CISA adds Fragnesia Linux kernel flaw (CVE-2026-46300) to KEV; attackers reportedly chain it with PHP2Shell to root serv; CVE-2026-109619 — CISA adds Fragnesia Linux kernel flaw (CVE-2026-46300) to KEV; attackers reportedly chain it with PHP2Shell to root serv. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2026-46300

vuln:CVE-2026-109618

vuln:CVE-2026-109619

cpe:"cpe:/a:php:php"

product:"Php"

host.services: (software.product = "Php")

cpe:"cpe:/a:paloaltonetworks:panorama_virtual_appliance"

product:"Panorama Virtual Appliance"

host.services: (software.product = "Panorama Virtual Appliance")

cpe:"cpe:/a:siemens:amis_ts"

product:"Amis Ts"

host.services: (software.product = "Amis Ts")

cpe:"cpe:/a:siemens:energy_engage"

product:"Energy Engage"

host.services: (software.product = "Energy Engage")

http.title:"Panorama"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD names 12 more affected products (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Banner spellings: a model read 4 from the NVD names and this card's text (former and marketing names, console titles); 1 matched something on Shodan and is shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 05:36Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Were the 25 devices in Dream's campaign PAN-OS? [S1] links the two reports but does not say so explicitly.
• [S5] calls the 25 devices firewalls; [S6] and [S1] call them servers.
• Is the honeypot-observed RCE against Apache mod_php 8.4.26 in [S4] tied to CVE-2026-115560 or to PHP2Shell?
• A public PoC repo (ikow/php2shell-poc, with five RCE chains and detection rules) was flagged by the pipeline on 2026-10-29. No numbered source covers it; verify before citing.
• Which kernel versions fix CVE-2026-46300?
• Did the backdoor AD account creation succeed?

Sources

• [S1] https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html · The Hacker News
• [S2] https://www.bleepingcomputer.com/news/security/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability/ · BleepingComputer
• [S3] https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html · The Hacker News
• [S4] https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/ · BleepingComputer
• [S5] https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html · The Hacker News
• [S6] https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks/ · BleepingComputer

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.