Patched in May, a Linux flaw is still helping hackers take over firewalls

A single web request, less than a quarter of an hour, and the firewall belongs to the hackers. That is what the company Dream Security describes. On October 25, it found the tools of a campaign run between October 8 and 24. The attackers chained two flaws: PHP2Shell, the critical vulnerability in the PHP language that has been exploited for a few days, and Fragnesia, a Linux kernel flaw known since May.

On October 28, the U.S. cybersecurity agency (CISA) added Fragnesia (CVE-2026-46300) to its catalog of actively exploited vulnerabilities. According to BleepingComputer, CISA says it can be combined with PHP2Shell to install backdoors (“webshells”) and run commands with the highest privileges, those of the root user. The agency gave no further detail about these attacks.

Why two flaws are better than one for hackers

On its own, the PHP flaw was not enough. According to Dream Security, PHP2Shell gave access to the web administration server of the targeted firewalls, but only with an unprivileged account (“nobody”). The SELinux security module prevented that account from modifying system files. Fragnesia removed the obstacle: the hackers used it to rewrite the configuration of the su command, which then let them become root without a password.

As with the first alerts about PHP2Shell, the scale raises questions. According to Dream Security, about 19,000 firewalls exposed on the Internet were identified, 240 were selected, and 24 were taken over during the automated phase. A 25th server, the one that managed the firewalls internally, was reached afterward from the equipment of an organization linked to the U.S. government. The victims are in the United States, Japan, Taiwan and South Korea.

Who is behind it? Dream Security names no one. The company notes clues pointing to China: the reconnaissance and tunneling tools used, the time zones, instructions in Chinese in the session logs, and a tool configured with the DeepSeek and Kimi AI models. Claude Code was also installed on the infrastructure, but Dream has no direct proof that it wrote the attack code. The firewall manufacturer has not been disclosed.

A Linux kernel flaw public for five months

Fragnesia was disclosed on May 13, 2026, by researcher William Bowling (V12 Security), with proof-of-concept code and a patch. It lets any local user become an administrator, with no special conditions, on most distributions where “namespaces” are enabled by default. Tenable gives it an estimated score of 7.8 out of 10. It is all the more dangerous because a hacker who gets in through a web flaw such as PHP2Shell ends up in exactly the position of that local user.

What to do

There is nothing new about the attack: both flaws already had a patch. It simply exploits servers that were updated late.

• Update the kernel by following your distribution’s advisory. AlmaLinux, Fedora and Ubuntu have published patched kernels. According to Tenable, Amazon Linux is not affected.
• Caution: according to Tenable, kernel patches for the related “Dirty Frag” family of flaws do not protect against Fragnesia. However, according to Tenable and Ubuntu, the module blocking recommended against Dirty Frag also protects against Fragnesia.
• If you can’t reboot: Tenable explains how to unload and block the esp4, esp6 and rxrpc modules. This may cut off IPsec VPNs that depend on them.
• Patch PHP and take firewall administration interfaces off the Internet.
• Look for traces: webshells, persistent tunnels, changes in the Active Directory directory. Dream Security recommends assuming that a compromised firewall may have opened access to company accounts.

One question remains: which firewalls were targeted? Until the manufacturer speaks up, its customers can’t know whether they are among the targets.

Update of November 13, 2026

The manufacturer of the firewalls targeted by the campaign described by Dream Security is now known: it is Palo Alto Networks. On October 29, Unit 42, the vendor’s threat intelligence team, said that the PHP2Shell flaws were being actively exploited against the administration interfaces of PAN-OS, the operating system of its firewalls, when they are exposed on the Internet. Unit 42 says it independently verified the attacker’s tools and confirmed the results published by Dream, including the chaining with a Linux kernel privilege escalation flaw.

According to Unit 42, about 0.02% of Palo Alto devices installed worldwide were affected. According to The Register, the attackers were targeting PAN-OS versions 12.1 and 12.2. Palo Alto points to its security advisory for the list of vulnerable and patched versions. It says customers who applied its patches against PHP2Shell are not affected.

Dream also found artificial intelligence tools in the attacker’s infrastructure: Anthropic’s Claude Code had been installed there, along with an offensive platform called aiscan, configured with the Chinese models DeepSeek and Kimi. According to Dream, the operation does not appear to have been fully autonomous, and there is no direct proof that these tools were used to write the exploit or the scripts.