Changed since version 1

• CVE-2026-46300 (Fragnesia) added to CISA KEV on 2026-10-29: folded into what_happened, timeline, triage reason and scope [S5].
• Public PoC repo ikow/php2shell-poc with five RCE chains and Suricata/Sigma/ModSecurity rules: added to what_happened, timeline, verify, coverage_checks and re-entry triggers [S6].
• Triage reason now rests on KEV status for all three chained CVEs plus public PoC availability [S4][S5][S6].
• Added sources S5 (CISA KEV catalog) and S6 (PoC repo).

What happened

• PHP patched two unauthenticated RCEs, PHP2Shell (CVE-2026-109618/109619), on Oct 21. Amazon reports targeting began four days before the patches shipped, though several firms rated those earlier attempts unsuccessful [S4].
• CISA added CVE-2026-109618 and CVE-2026-109619 to KEV [S4].
• Dream reports an Oct 23–25 operation that used a custom PHP2Shell exploit against session.upload_progress on an undisclosed vendor's firewall appweb management server. It chained the Fragnesia LPE to root 25 devices in the US, Japan, Taiwan and South Korea [S1].
• The actor planted PHP web shells, built a reverse SSH tunnel, decrypted an LDAP service account password, enumerated AD, sprayed passwords and attempted to create backdoor AD accounts. Whether credential theft and account creation succeeded is unconfirmed [S1].
• CISA added CVE-2026-46300 (Fragnesia) to KEV on Oct 29 based on evidence of active exploitation [S5].
• A public repo, ikow/php2shell-poc, publishes five RCE chains for CVE-2026-109618/109619 plus Suricata, Sigma and ModSecurity rules [S6].

Timeline

Detect

ad_spray_from_appliance_ip_then_account_creation · windows_eventlog → windows_eventlog · proposer hunt, speculative

index=<windows_eventlog> (EventCode=4625 OR EventCode=4720) | eval stage=if(EventCode==4625,"spray","create") | bin _time span=1h as hour | stats dc(eval(if(stage=="spray",TargetUserName,null()))) as sprayed_users count(eval(stage=="spray")) as failures values(eval(if(stage=="spray",src_ip,null()))) as spray_sources min(eval(if(stage=="spray",_time,null()))) as first_fail values(eval(if(stage=="create",TargetUserName,null()))) as created_accounts min(eval(if(stage=="create",_time,null()))) as first_create by Computer | where sprayed_users>=20 AND isnotnull(first_create) AND first_create>first_fail AND first_create-first_fail<86400 | sort - first_create

FROM <windows_eventlog> | WHERE event.code IN ("4625", "4720") | EVAL stage = CASE(event.code == "4625", "spray", "create"), fail_user = CASE(stage == "spray", user.name, NULL), fail_ts = CASE(stage == "spray", @timestamp, NULL), create_ts = CASE(stage == "create", @timestamp, NULL) | STATS sprayed_users = COUNT_DISTINCT(fail_user), failures = COUNT(*) WHERE stage == "spray", spray_sources = VALUES(source.ip) WHERE stage == "spray", first_fail = MIN(fail_ts), created_accounts = VALUES(user.target.name) WHERE stage == "create", first_create = MIN(create_ts) BY host.name | WHERE sprayed_users >= 20 AND first_create IS NOT NULL AND first_create > first_fail AND DATE_DIFF("seconds", first_fail, first_create) < 86400 | SORT first_create DESC

A hit means: Failed logons against many users from one source, then a new account on the same DC within a day, match the actor's tunnelled spray and backdoor-account attempt [S1]. Escalate only when a spray source is a firewall or management-appliance IP. · Noise: Vulnerability scanners, misconfigured service accounts and help-desk provisioning produce both failed-logon bursts and routine 4720 events on busy DCs; restrict spray_sources to firewall/management appliance IPs (the story's pivot point), exclude known scanner IPs, and exclude 4720 events whose SubjectUserName is an approved provisioning/IAM service account.

Verify

• Confirm the spray_sources are firewall or management-appliance IPs. These should never authenticate to a DC, so appliance-originated AD auth is the strong signal [S1].
• Match every created account against change tickets and help-desk provisioning.
• Tie the chain together: look for new PHP files in firewall web roots and outbound SSH from the same appliance in the same window [S1].
• Benign look-alikes: vulnerability scanners and misconfigured service accounts produce 4625 bursts, and routine provisioning produces 4720.
• Treat web-log traffic that matches the public PoC's session.upload multipart requests as a likely exploit attempt. Researchers or scanners running the PoC produce the same signal [S6].

Scope

Affected

• Undisclosed vendor's firewall OS running PHP 8.0.30 and newer release branches [S1]
• PHP deployments not yet on the fixed releases for CVE-2026-109618/109619 [S4]
• Linux kernels vulnerable to Fragnesia CVE-2026-46300 [S1][S5]
• PHP apps that combine a non-default php_binary/php_serialize serialize_handler, an ini_set switch to php before session_start(), and upload progress enabled (CVE-2026-115560) [S2]

Only if

• Firewall management interface is exposed to the internet, or is reachable internally from an already-compromised device [S1]
• session.upload_progress is reachable on the PHP target [S1]

Not affected if

None stated by the sources.

Fixed in: PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 for PHP2Shell; EOL ≤8.1 (including the 8.0.30 seen on the firewalls) gets no PHP fix; CVE-2026-115560 has a mitigation only; no kernel fix version for CVE-2026-46300 in the sources

Enumerate

• Firewall appliances, their PHP branch and management-interface exposure
• PHP versions across the estate, including EOL ≤8.1 installs
• Linux kernel versions exposed to CVE-2026-46300
• PHP apps with the CVE-2026-115560 configuration pattern
• The AD LDAP service account and accounts created since Oct 17

Contain

• Preserve appliance logs, web roots and memory first. Then remove internet exposure of firewall management interfaces.
• Block outbound SSH from firewall and appliance networks except to known-good destinations.
• Set session.upload_progress.enabled=0 on exposed PHP where feasible. This is PHP's mitigation for CVE-2026-115560 and also reduces the PHP2Shell vector [S1][S2].
• Rotate the LDAP service account and any credentials reachable from a compromised appliance. Rotation cannot be undone, so capture evidence first.
• Disable any unapproved AD accounts created since the campaign window. Keep them disabled rather than deleted, so they remain available as evidence.

Eradicate

• Remove the PHP web shells from firewall web roots [S1].
• Tear down the reverse SSH tunnel and any persistence on rooted appliances. Rebuild rooted devices rather than clean them in place, since the actor had root.
• Patch PHP and kernels (CVE-2026-46300) on all affected hosts.
• Remove backdoor AD accounts if any account creation succeeded [S1].

Recover

• Before returning a device to service, confirm that PHP and the kernel are patched or that the vendor has shipped firmware, and that management interfaces are not exposed.
• Validate AD: there should be no unapproved accounts, and the LDAP service account should have rotated credentials.
• Afterwards, monitor for renewed spraying, appliance-originated authentication, new outbound SSH, and web-root file changes.

Re-enter the loop when

• The firewall vendor is named or publishes an advisory or firmware fix.
• Exploitation is reported against CVE-2026-115560, or it is added to KEV.
• Exploitation surges, or new chains appear, derived from the public PoC [S6].
• Evidence shows AD credential theft or backdoor account creation succeeded.
• New IoCs (tunnel endpoints, web-shell names) are published for the campaign.

Debrief

• Record which appliances were rooted, web-shell paths, tunnel endpoints, the scope of any AD spraying, and the timing of the LDAP account rotation.
• Record the patch dates for PHP and kernels against the KEV listing dates.
• Gaps in the sources: the firewall vendor is undisclosed; the outcome of credential theft and account creation is unconfirmed; the campaign rests on one secondary report [S1]; no kernel fix version for Fragnesia is given.

Detection coverage — checked automatically

Checked automatically 2026-10-30 09:48Z from public sources: 30 published, 15 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2026-109618

vuln:CVE-2026-109619

vuln:CVE-2026-115560

cpe:"cpe:/a:php:php"

product:"Php"

host.services: (software.product = "Php")

cpe:"cpe:/a:paloaltonetworks:panorama_virtual_appliance"

product:"Panorama Virtual Appliance"

host.services: (software.product = "Panorama Virtual Appliance")

NVD names 2 more affected products (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-30 09:48Z from the CVE ids and NVD's CPE configurations; re-built daily with the coverage check.

Open questions

• Which vendor's firewall was targeted, and is a firmware fix available, given that PHP 8.0 is EOL?
• Did the LDAP credential decryption or backdoor account creation succeed?
• Which fixed kernel versions address CVE-2026-46300? None of the sources here says.
• Does the honeypot-observed RCE against mod_php 8.4.26 relate to CVE-2026-115560 or to PHP2Shell? S4 is ambiguous.
• The proposed hunt uses an index placeholder (<windows_eventlog>). It is returned unchanged as the proposer wrote it; the analyst should replace it with index=* per policy.
• The PoC repo's detection rules are third-party and have not been reviewed here.

Sources

• [S1] https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html · The Hacker News
• [S2] https://www.bleepingcomputer.com/news/security/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability/ · BleepingComputer
• [S3] https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html · The Hacker News
• [S4] https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/ · BleepingComputer

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.