PHP2Shell Plus a Linux Flaw Is Now Taking Over Firewalls: What to Check

Last week we wrote about PHP2Shell, a pair of critical PHP flaws that let an attacker run code on a web server without logging in. There is an important update. On October 28, 2026, CISA added a Linux kernel flaw called Fragnesia (CVE-2026-46300) to its list of vulnerabilities known to be exploited, and said attackers can chain it with PHP2Shell "to implant PHP webshells and run commands as root."

In plain terms: PHP2Shell gets an attacker a foot in the door, and Fragnesia turns that into full control of the device.

The short version: if you run Palo Alto Networks PAN-OS or Panorama, make sure the management interface cannot be reached from the internet, restrict it to trusted internal IP addresses, and apply Palo Alto's fix. Also keep Linux servers and appliances updated for both PHP2Shell and Fragnesia.

What researchers found

In an October 26, 2026 report, the security research firm Dream described a campaign that used the two flaws together against firewalls from one large vendor. On October 29, 2026, Dream updated that report to name the vendor: Palo Alto Networks. The attacks hit internet-exposed PAN-OS and Panorama management interfaces — the management web UI and the XML API, not GlobalProtect. According to the report:

• The attacker searched the internet for about 19,000 of these firewalls whose management interfaces were exposed online.
• They narrowed that to 240 targets and took full control of 24 firewalls, plus one internal firewall management server reached through one of them, for 25 systems in the United States, Japan, Taiwan and South Korea.
• The whole chain, from a single unauthenticated web request to a hidden root webshell, took under 15 minutes.
• On most of the firewalls the attacker simply left a webshell behind to come back later. At one organization they went further: they built a tunnel into the internal network, pulled a stored directory account password from the firewall configuration, listed every user and group in Active Directory, and tried password spraying, which the report notes was helped by the domain having no account lockout.

Fortinet FortiOS, TP-Link Omada and MikroTik RouterOS are not reported as affected by this chain.

What Fragnesia is

Red Hat describes Fragnesia as a Linux kernel flaw in the IPsec networking code that lets someone who already has a low-privilege foothold on a system gain root, the highest level of access. It is part of a group of related kernel flaws called "Dirty Frag." Red Hat rates it Important rather than Critical because on its own it needs local access. Chained with PHP2Shell, that local access is no longer hard to get. Red Hat and other Linux vendors have released fixed kernels.

Who is at risk

• Palo Alto Networks PAN-OS firewalls and Panorama whose management web UI or XML API is reachable from the internet.
• Linux web servers and hosting panels running a PHP version affected by PHP2Shell on an unpatched kernel.
• Other Linux-based devices in the office, such as storage boxes or camera recorders, if they run PHP and are exposed to the internet.

What to do this week

1. Take firewall management off the internet. The management page should only be reachable from inside your network or through your VPN. Dream notes the whole campaign started from management interfaces that should never have been exposed to the internet.
2. If you run PAN-OS or Panorama: restrict the management interface to trusted internal IP addresses, and apply Palo Alto Networks' fix for the affected versions. Palo Alto's advisory lists the fixed releases and workarounds.
3. Install your firewall vendor's latest updates and watch for any advisory about PHP2Shell or Fragnesia from them.
4. Update Linux servers. Install the fixed kernel from your Linux vendor and reboot, and update PHP to a fixed release (8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later). If a kernel update has to wait, Red Hat's bulletin lists temporary workarounds.
5. Look for signs of a break-in. Ask your IT provider to check exposed devices for unfamiliar files in web folders, unexpected scheduled tasks or services, and outbound connections you don't recognize. If a device was exposed and unpatched, treat it as possibly compromised and change the passwords stored on it.
6. Tighten Active Directory. Turn on account lockout after repeated failed sign-ins, make sure service accounts used by firewalls and VPNs have strong passwords and only the access they need, and keep multifactor sign-in on remote access.

Questions to ask your IT provider

1. Can our firewall's management page be reached from the internet?
2. If we run PAN-OS or Panorama, is the management interface limited to trusted internal IPs, and have we applied Palo Alto's fix?
3. Is our firewall on its vendor's latest version, and has the vendor said anything about PHP2Shell or Fragnesia?
4. Are our Linux servers and appliances patched for CVE-2026-46300 and PHP2Shell?
5. Do we have account lockout turned on in Active Directory?