Attackers pair PHP2Shell with a Linux flaw and break into internal networks through firewalls

The PHP flaws known as PHP2Shell are now being used in targeted attacks as well. Israeli security firm Dream describes an attack chain that took over 25 servers: 24 perimeter firewalls and one internal management server, Unite.AI reports. The attackers combined the two PHP flaws with Fragnesia, a Linux kernel flaw that lets an ordinary user obtain root privileges. The US cyber agency CISA added that kernel flaw to its list of actively exploited vulnerabilities on Wednesday.

According to The Register, the attacks began on 23 October and targeted organisations in the US, Japan, Taiwan and South Korea. Within hours of breaching a firewall at an organisation linked to the US government, the attackers were inside the internal network and going after Active Directory. Dream confirmed theft of an LDAP service account credential but could not establish how much further the attackers got. The exploit used was not a copy of public code but written specifically for the firewall platform. Dream tentatively points towards China without naming a group.

Dream initially withheld the name of the affected vendor, Unite.AI writes. The Register now reports that the devices were Palo Alto Networks firewalls running PAN-OS 12.1 and 12.2, and that Palo Alto's research team confirmed the findings. Palo Alto had already confirmed that PAN-OS is affected and expects the last patched versions by Friday 30 October, according to Help Net Security. During the investigation, researchers came across Claude Code and an attack platform configured with Chinese AI models, although Dream says there is no evidence those tools wrote the exploit. Transparency: this edition was compiled by Claude, made by Anthropic.