PHP2Shell Investigation Maps Exploit Tooling and Reported PAN-OS Compromises

Oct 30, 2026 · Original article ↗

Summary

Hunt IO mapped 616 PHP2Shell-related files and analyzed exploit kits and operator activity. Dream Research reported PHP2Shell and Fragnesia were used to root 25 PAN-OS servers; Unit 42 later reported verifying the tooling and results.

Key points

Hunt IO found 616 PHP2Shell-related files in indexed open directories, including cloned proof-of-concepts, custom heap exploits, scanners, and post-exploitation tools; exposed tooling alone does not prove a target was hit.
A byte-identical ASLR-bypass kit appeared on four hosts. Operator logs showed it executing a shell as www-data in lab environments, not confirmed production victims.
Dream Research reported attackers chained PHP2Shell with the Fragnesia privilege-escalation vulnerability (CVE-2026-46300) to obtain root access on 25 PAN-OS servers; Unit 42 later reported verifying the tooling and results.
Dream Research said the campaign identified about 19,000 internet-facing firewalls, found around 5,000 responsive devices, and narrowed the targets to 240 before the reported compromises.
watchTowr, 0x4D31, and GreyNoise reported shell execution in honeypots or sensors. Wiz and CrowdStrike reported no end-to-end exploitation in their own telemetry.
The article found no evidence of reliable mass compromise across the open internet. In one government-target attempt, PHP2Shell failed and the operator later used a different vulnerability.
Recommended defenses include upgrading to patched PHP versions, disabling session.upload_progress.enabled as a temporary measure, and monitoring for suspicious multipart requests and web-server workers spawning shells.

Article Details

Attack Vectors: PHP2Shell exploits CVE-2026-109618 and CVE-2026-109619 through multipart uploads and PHP session.upload_progress, corrupting memory to pursue unauthenticated remote code execution.
Where a local file inclusion vulnerability already exists, operators can write PHP code into a session file through session.upload_progress and trigger it through the include bug.
A custom implementation adapted PHP2Shell to PAN-OS management interfaces; the reported campaign then used CVE-2026-46300 (Fragnesia) to escalate from web-server execution to root.
Operators used reconnaissance and scanning to identify and narrow internet-facing PAN-OS targets. The article reports one campaign selecting 240 targets from approximately 19,000 identified firewalls.
A captured dropper retrieved a second-stage payload with wget or curl and made an HTTP beacon to an integer-encoded IP address.
Defensive Notes: Upgrade PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12, as appropriate, to address CVE-2026-109618 and CVE-2026-109619.
If patching is delayed, disable session.upload_progress.enabled in php.ini.
Alert on multipart POSTs with no User-Agent, a short boundary, and an oversized PHPSESSID cookie; correlate repeated multipart POSTs to the same PHP endpoint.
Alert when apache2 or php-fpm workers spawn /bin/sh, and monitor for outbound connections from those workers to raw IP addresses without SNI.
Patch or restrict PAN-OS management interfaces and monitor for exploitation attempts and privilege escalation.

Indicators of compromise

Type	Indicator	Context
IPV4	`101[.]133[.]233[.]159`	Host serving the shared 9bie ASLR-bypass kit and a scanner; operator logs showed lab execution as www-data.
IPV4	`130[.]12[.]180[.]89`	Host containing logs of failed PHP2Shell attempts against a government target before the operator pivoted to another vulnerability.
IPV4	`130[.]94[.]67[.]235`	Host serving a PHP2Shell exploit-chain adaptation targeting PAN-OS management interfaces.
IPV4	`144[.]217[.]161[.]236`	Staging host associated with PHP2Shell tooling and staged government-finance targets.
IPV4	`15[.]204[.]59[.]70`	Confirmed source of PHP2Shell honeypot shells and post-exploitation staging; its dropper retrieved a second stage and beaconed back to this host.
IPV4	`152[.]42[.]245[.]8`	Staging host associated with PHP2Shell tooling and staged commercial targets.
IPV4	`162[.]35[.]99[.]94`	Confirmed source of PHP2Shell honeypot shells; its open directory also contained a separate Metabase/H2 RCE gadget.
IPV4	`18[.]136[.]195[.]202`	Host staging a cloned PHP2Shell proof of concept and exploit documentation.
IPV4	`185[.]242[.]106[.]140`	Operational toolkit host containing PHP2Shell exploit scripts, scanners, and a log cleaner.
IPV4	`2[.]59[.]133[.]151`	Reported source of five PHP2Shell shells on GreyNoise sensors.
IPV4	`208[.]115[.]245[.]102`	Host in a staging cluster serving cloned PHP2Shell PoCs and a running exploit copy.
IPV4	`208[.]115[.]245[.]98`	Host in a staging cluster serving cloned PHP2Shell PoCs and a running exploit copy.
IPV4	`208[.]115[.]245[.]99`	Host in a staging cluster serving cloned PHP2Shell PoCs and a running exploit copy.
IPV4	`23[.]27[.]25[.]75`	Staging host associated with PHP2Shell tooling and staged education and commercial targets.
IPV4	`34[.]146[.]20[.]31`	Host serving the shared 9bie ASLR-bypass kit; operator logs showed lab execution as www-data.
IPV4	`38[.]60[.]136[.]217`	Host serving the shared 9bie ASLR-bypass kit; operator logs showed lab execution as www-data.
IPV4	`45[.]225[.]135[.]53`	Host identified as an SMTP/XXE operator and PHP2Shell scanner.
IPV4	`45[.]39[.]190[.]176`	Development and staging host containing PHP2Shell exploit tooling, including a session-LFI exploit.
IPV4	`85[.]121[.]179[.]129`	Exploit-development host containing PHP2Shell heap-exploit research and logs showing a working address leak.
IPV4	`96[.]126[.]130[.]81`	Host serving a variant of the shared 9bie ASLR-bypass kit, with lab RCE evidence.
SHA256	`1c93ea48fa7ff886a6d81e44869dd7962309e95d01c1561df362b0b18007a562`	SHA-256 of panos_rce_poc.py, the PAN-OS-focused PHP2Shell exploit.
SHA256	`2d692ee6dcb41c249c55881897b7dec0550b92963e07fccdb11ad655601977c3`	SHA-256 of the sc.py PHP2Shell heap RCE tool.
SHA256	`4a1502affa36d106d5374bf02cf777956eef651176ec8964b26ff90f103dd506`	SHA-256 of poc.sql, the separate Metabase/H2 RCE gadget found on 162.35.99[.]94.
SHA256	`535b9e298defd3449ba2b10b9828925d3ce344872dcbd9470c0e8db20f0aae83`	SHA-256 of the murrez PHP2Shell poc.py exploit.
SHA256	`5e99d6023dce9bb18d845a37fcdbc7ea574fdb20ab8d888ec54c695382d46036`	SHA-256 of aslr_run.py, the leak tool associated with the shared 9bie kit.
SHA256	`66bcbc8c2b9d847a1e976e57972e10eac98e9b894cbf30510bff1e8d63efb81f`	SHA-256 of a PHP2Shell-related scanner.
SHA256	`6f84cc354b785157983efa8f4b674d2e1d6c3331017f29ff8d51bc43668d4b0f`	SHA-256 of the shared session-LFI exploit, identified as vcript.py / chain_a_session_lfi.py.
SHA256	`9c15dc5a510bf2e8a16c846e61fa35c50ef733b72d4e47b6e8307498a398443c`	SHA-256 of a README associated with the PHP2Shell exploit tooling.
SHA256	`c1e81cfbaf7e4cccad7d7f43c1a624b791ba1b7f1d176e224455138604837b4c`	SHA-256 of the shared 9bie ASLR-bypass exploit found across multiple hosts.