Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers

Dream researchers report that an attacker chained a custom PHP2Shell exploit (CVE-2026-109618/109619) with the Fragnesia kernel flaw (CVE-2026-46300) to root 25 Palo Alto PAN-OS management servers, including three in a US government-affiliated network, and then moved toward Active Directory. Dream says Unit 42 verified the tooling. The chain needs version-specific memory offsets, and the campaign narrowed about 19,000 exposed devices to 240 targets. Most details come from Dream alone, and attribution to Chinese actors rests on indicators. Teams should keep management interfaces off the internet and patch.