Posted on

2026-10-30 — PAN-OS PHP2Shell + Fragnesia Root Chain — Sentinel Hunts

Threat Overview

A newly corroborated October 29 update to PHP2Shell threat intelligence identifies a **real intrusion chain against Internet-exposed PAN-OS management interfaces**. Dream Research published artifacts of a campaign in which attackers exploited PHP2Shell (`CVE-2026-109618` / `CVE-2026-109619`) for initial code execution and then Fragnesia (`CVE-2026-46300`), a Linux kernel XFRM ESP-in-TCP local privilege-escalation flaw, to obtain root. Dream reported 25 compromised firewall/management servers; Palo Alto Networks Unit 42 says it independently verified the same attacker tooling and results. The chain reportedly altered `/etc/pam.d/su` to use `pam_permit.so`, planted a root webshell at `/unauth/php/change_password.php`, and in selected cases moved into Active Directory. This is a **new PAN-OS-specific exploitation confirmation**, not a claim that all PHP applications or all Linux systems are remotely exploitable through Fragnesia alone. Attribution to a Chinese operator and AI assistance remains researcher assessment, not proven fact.

References

Impacted Systems

  • Vendor/product: Palo Alto Networks **PAN-OS** management web UI/XML API on PA-Series/VM-Series firewalls and Panorama (virtual/M-Series), on-prem or self-managed. **GlobalProtect portal/gateway/Clientless VPN and Captive Portal are explicitly not affected** by this PAN-OS PHP2Shell issue, per vendor.
  • Affected PAN-OS trains include unpatched **10.2, 11.1, 11.2, 12.1 and 12.2** builds; exact hotfix depends on minor release. Confirm against the vendor matrix; examples: **12.2.4-h1**, **12.1.10-h3**, **11.2.16-h1**, **11.1.16-h4**, **10.2.18-h13** (or the corresponding fixed hotfix for an older minor release).
  • Prerequisite/exposure: reachable management HTTPS/XML API, particularly from the public Internet; no authenticated account needed for the documented PHP2Shell entry. Do not equate GlobalProtect service exposure alone with vulnerable management access.
  • Fragnesia (CVE-2026-46300): **local** Linux kernel privilege escalation in ESP-in-TCP; attacker needs code execution or a local foothold first. Affected kernel packages and fixes are distribution/build-specific; RHEL 8/9/10 and multiple Ubuntu kernel flavors have vendor updates. Ubuntu 20.04 generic kernel is listed not affected. Do not infer kernel vulnerability from a generic version string alone.
  • PAN-OS signatures documented by vendor: Threat ID **543004**, **97622–97678** (selected published IDs in queries). Reported webshell path: `/unauth/php/change_password.php`. Exact management IP/port is deployment-specific; HTTPS commonly uses TCP 443 but can be reconfigured.

Why this matters

The firewall management plane can expose the internal network. Palo Alto confirmed active exploitation of a PHP2Shell-to-root chain and published fixed PAN-OS builds.

Exploitation Status

**Confirmed exploitation:** Palo Alto Networks states PAN-OS management interfaces exposed to the Internet were attacked and independently corroborates Dream’s campaign tooling/results. **Researcher attribution:** Dream assesses the operation as Chinese/AI-assisted based on artifacts; direct evidence of AI writing the exploit is not established. **Fragnesia:** a local-only escalation after initial code execution, not an unauthenticated remote flaw on its own.

What this hunt looks for

Vendor threat signatures, reported webshell requests, abnormal management PHP POST traffic, web-origin command execution, PAM changes, Linux authentication anomalies and unusual AD source IPs.

Required logs

  • CommonSecurityLog: 01 — First pass: published PAN-OS PHP2Shell prevention signature IDs
  • CommonSecurityLog: 02 — Reported root webshell path requested over HTTP
  • CommonSecurityLog: 03 — PAN management PHP-related POST requests from public sources
  • DeviceProcessEvents: 04 — Web-server process launching privileged or recon commands
  • DeviceProcessEvents: 05 — Commands referencing PAM su configuration or pam_permit
  • DeviceFileEvents: 06 — Modification of PAM su file on onboarded Linux systems
  • Syslog: 07 — Syslog su authentication and PAM anomalies
  • SecurityEvent: 08 — AD authentication from rare source IPs after possible edge compromise

KQL Hunting Content

01 — First pass: published PAN-OS PHP2Shell prevention signature IDs

let ThreatIds = dynamic(["543004","97622","97623","97624","97625","97643","97647","97649","97652","97653","97656","97657","97658","97659","97662","97663","97664","97670","97671","97672","97673","97674","97676","97677","97678"]);
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend EventId=tostring(column_ifexists("DeviceEventClassID", "")), Raw=coalesce(tostring(column_ifexists("AdditionalExtensions", "")), "")
| where EventId in (ThreatIds) or (DeviceVendor =~ "Palo Alto Networks" and (Activity contains "PHP2Shell" or Message contains "CVE-2026-109618" or Message contains "CVE-2026-109619"))
| project TimeGenerated, DeviceVendor, DeviceProduct, DeviceName, SourceIP, DestinationIP, DeviceAction, EventId, Activity, Message, Raw
| order by TimeGenerated desc

02 — Reported root webshell path requested over HTTP

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend Uri=tostring(column_ifexists("RequestURL", ""))
| where Uri contains "/unauth/php/change_password.php"
| project TimeGenerated, SourceIP, DestinationIP, DeviceVendor, DeviceProduct, DeviceAction, Activity, Uri
| order by TimeGenerated desc

03 — PAN management PHP-related POST requests from public sources

CommonSecurityLog
| where TimeGenerated >= ago(14d)
| extend Uri=tostring(column_ifexists("RequestURL", "")), Method=toupper(tostring(column_ifexists("RequestMethod", "")))
| where Method == "POST" and (Uri contains "/php/" or Uri contains "/unauth/")
| where isnotempty(SourceIP) and ipv4_is_private(SourceIP) == false
| summarize Requests=count(), Paths=make_set(Uri, 5), Actions=make_set(DeviceAction, 5) by SourceIP, DestinationIP, bin(TimeGenerated, 10m)
| where Requests >= 10
| order by Requests desc

04 — Web-server process launching privileged or recon commands

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("appweb", "httpd", "apache2", "php", "php-fpm", "php-cgi")
| where FileName in~ ("su", "sudo", "id", "sh", "bash", "python", "python3", "curl", "wget", "openssl")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc

05 — Commands referencing PAM su configuration or pam_permit

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where ProcessCommandLine contains "/etc/pam.d/su" or ProcessCommandLine contains "pam_permit.so"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| order by TimeGenerated desc

06 — Modification of PAM su file on onboarded Linux systems

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FileName =~ "su" and FolderPath contains "/etc/pam.d/"
| where ActionType in~ ("FileCreated", "FileModified", "FileRenamed")
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc

07 — Syslog su authentication and PAM anomalies

Syslog
| where TimeGenerated >= ago(30d)
| where ProcessName in~ ("su", "sudo", "sshd", "audit") or SyslogMessage contains "pam_permit.so" or SyslogMessage contains "/etc/pam.d/su"
| where SyslogMessage contains "session opened for user root" or SyslogMessage contains "pam_permit.so" or SyslogMessage contains "authentication failure" or SyslogMessage contains "/etc/pam.d/su"
| project TimeGenerated, Computer, Facility, ProcessName, SyslogMessage
| order by TimeGenerated desc

08 — AD authentication from rare source IPs after possible edge compromise

let KnownSources = SecurityEvent
| where TimeGenerated between (ago(30d) .. ago(3d)) and EventID in (4624, 4625, 4768, 4769)
| extend Src=tostring(column_ifexists("IpAddress", ""))
| where isnotempty(Src) and Src !in ("-", "::1", "127.0.0.1")
| summarize by Src;
SecurityEvent
| where TimeGenerated >= ago(3d) and EventID in (4624, 4625, 4768, 4769)
| extend Src=tostring(column_ifexists("IpAddress", ""))
| where isnotempty(Src) and Src !in ("-", "::1", "127.0.0.1")
| join kind=leftanti (KnownSources) on Src
| summarize Events=count(), Accounts=make_set(Account, 8), EventIds=make_set(EventID, 5) by Src, Computer, bin(TimeGenerated, 1h)
| where Events >= 5
| order by Events desc

Detection Notes

  • Highest signal: published PAN-OS PHP2Shell threat signatures, the campaign webshell URI, and root/PAM anomalies on any onboarded Linux web hosts.
  • PAN-OS management interface traffic can bypass ordinary firewall data-plane telemetry; do not assume that generic network logs contain the exploit requests.
  • Threat IDs are PHP2Shell controls, not specific indicators of the Fragnesia kernel exploit. Exact application-level payload is often encrypted or not logged.
  • The Fragnesia page-cache modification may not appear as a normal file write; kernel/root access may also suppress Syslog or appliance logs.
  • Generic AD authentication from a new source is contextual only. Validate source IP against confirmed PAN-OS management IPs before linking it to this campaign.
  • PAN-OS hotfixes are minor-build-specific. Palo Alto notes the 11.2.10-h16 exception for Brotli coverage; verify all relevant fixes separately.
  • 01 — First pass: published PAN-OS PHP2Shell prevention signature IDs: IDs are published vendor signatures, not Fragnesia signatures. Some IDs are broader than this exploit; verify threat name and direction.
  • 02 — Reported root webshell path requested over HTTP: Dream observed this specific path in the PAN-OS campaign; not all exploit attempts use it. Requires HTTP URI visibility (decrypted traffic or proxy/WAF).
  • 03 — PAN management PHP-related POST requests from public sources: Generic PHP traffic is noisy. Scope DestinationIP to known PAN-OS management IPs before interpreting as attack attempts; this query alone cannot identify PAN-OS.
  • 04 — Web-server process launching privileged or recon commands: Generic post-exploitation signal on onboarded Linux web hosts. PAN-OS appliance process telemetry is normally NOT available in DeviceProcessEvents.
  • 05 — Commands referencing PAM su configuration or pam_permit: Dream documented PAM rule replacement during Fragnesia exploitation. Legitimate administration can touch PAM files; require process and change context.
  • 06 — Modification of PAM su file on onboarded Linux systems: The Fragnesia page-cache primitive may not generate conventional file-write events; absence of this result does not rule out exploitation.
  • 07 — Syslog su authentication and PAM anomalies: Broad Linux PAM fallback; root sessions are normal in many environments. The attacker may suppress appliance logs or bypass normal PAM messages.
  • 08 — AD authentication from rare source IPs after possible edge compromise: Not specific to PHP2Shell. To attribute, compare source IP to actual firewall management addresses; otherwise this is general rare-source authentication triage.