Vulnerabilities

Security firm Dream published an incident report on October 26 describing attackers who compromised 25 servers: 24 perimeter firewalls and one internal management server, including systems in a US government-affiliated environment. They did it by chaining PHP2Shell, the pair of PHP flaws patched on October 21, with a Linux kernel bug called Fragnesia. Dream did not name the firewall vendor or the software versions, and says it notified the vendor.

On October 28 CISA added Fragnesia (CVE-2026-46300) to its Known Exploited Vulnerabilities (KEV) catalog. If you run firewalls or other appliances whose management web interface can be reached from the internet, this is the attack path to check first.

How it works

Many firewalls and network appliances run a web management console on PHP, on top of a Linux kernel. The two bugs hit different layers. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets an unauthenticated request run code as the web server's own low-privilege account, by abusing PHP's memory handling during a failed request. Our earlier post covers that in detail.

On its own, that account is boxed in. Fragnesia is what lifts it out. It sits in the kernel's XFRM subsystem, in the code that handles ESP-in-TCP (IPsec packets wrapped in a TCP stream), and it gives a local, unprivileged user a write into the kernel's page cache, the in-memory copy of files. Microsoft's analysis, reported by SecurityWeek in May, describes overwriting the su binary to get a root shell, and says any file the user can read, /etc/passwd included, could be altered. Public proof-of-concept code exists, and distributions began shipping kernel fixes in May.

Put together, a request to the management page becomes code execution, and then root on the appliance. Dream says the entry point was an exposed management interface.

What attackers did

Amazon Threat Intelligence reported PHP2Shell exploitation attempts in its MadPot honeypot network from October 17, four days before the PHP project released fixes. Dream has not said when its 25 victims were compromised.

After rooting the firewalls, the attackers moved toward identity systems. Dream confirmed they stole an LDAP service-account credential, the account a firewall uses to look up users in the directory, and enumerated the directory with it. Dream could not confirm password spraying, creation of backdoor accounts or theft of SAML signing keys.

Dream also found Claude Code installed on compromised systems and an offensive platform configured with DeepSeek and Kimi models. It says it has no direct evidence these tools wrote the exploit or post-exploitation scripts and does not call the operation fully autonomous. It suggests a Chinese nexus but names no actor, and that attribution is tentative. Treat it as a lead, not a finding. The report published no indicators of compromise.

What to do

Remove the entry point. Restrict the management web interface and SSH to a management network or jump host. This works regardless of firmware state and is the one step that does not wait on a vendor.

Patch both layers. For PHP, appliances need the vendor's firmware, because a PHP version string on a packaged product does not tell you whether a fix was backported. Help Net Security's vendor roundup gives this status as of its publication:

• Palo Alto Networks: PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 on PA-Series, VM-Series and Panorama are affected through the management web interface. Fixed builds 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 were out, with 17 more due October 27 to 30. Until then, limit management access to trusted internal IPs and enable Threat Prevention IDs 543004 and 97622 to 97625 (content version 9162 or later). GlobalProtect and Captive Portal are not affected.
• Fortinet: FortiOS is among 43 products cleared. FortiDDoS, FortiClient Cloud Services, FortiSOAR and FortiSOAR PaaS were still under review, and FortiGuard virtual patches are in version 37.316 with IPS signatures in 37.317.
• Cisco: Ultra-Reliable Wireless Backhaul, Expressway and Duo Access Gateway are vulnerable, with 11 more products under investigation. Duo Access Gateway 3.2.0 and Expressway 15.5.21 carry fixes, while URWB 27.1.1 is expected in February 2027.

Check each vendor's own advisory, since these figures will have moved. For Linux hosts you run yourself, install your distribution's kernel update for CVE-2026-46300 and reboot. A running kernel keeps the vulnerable code until it restarts. CISA's KEV entry, as reported, carries an October 31 due date for federal agencies and calls for forensic triage under Binding Operational Directive 26-04.

Check whether you were hit. AWS advises investigating from the earliest known exploitation, which for PHP2Shell is October 17. On firewalls and management servers, look for management-interface requests from addresses that never log in, new or modified files under the web root, shells spawned by the web server process, and outbound SSH connections from the appliance that your team did not set up. In the directory, review authentications by the firewall's LDAP service account from any host other than the firewall, and large enumeration queries.

Clean up. If anything turns up, treat the appliance and its management server as compromised: reimage rather than clean, and treat the management server, the firewall and the directory as one attack path. Rotate the LDAP bind password, local admin accounts and any API keys or VPN secrets stored on the device.

The wider lesson

A bug rated for local attackers, like Fragnesia, is easy to defer on servers that are "not exposed". An internet-facing web panel turns any code-execution flaw into the first half of a local-privilege chain. Rank kernel fixes on appliances and management hosts by what can reach them, not by the CVSS wording.

If you want an outside view of which management interfaces you expose, our attack surface management work maps them, and our network penetration testing checks what an attacker could do from there. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Unite.AI on Dream's report, CISA KEV alert, October 28, SecurityWeek on Fragnesia, Help Net Security vendor status, Fortinet.