PHP2Shell Gave Them a Web Shell. A Six-Month-Old "Local" Kernel Bug Gave Them Root.

Quick Answer: The first confirmed PHP2Shell (CVE-2026-109618 and CVE-2026-109619) compromises did not stop at PHP. Attackers ran code as an unprivileged web user, then used a separate Linux kernel flaw, Fragnesia (CVE-2026-46300), to escalate to root. Fragnesia was patched back in May 2026 and is rated "local" with a CVSS of 7.8, so plenty of teams left it in the backlog. PHP2Shell is exactly the kind of flaw that turns a "local" bug into a remote one. If your servers were internet-facing before you patched PHP, your kernel patch level now matters as much as your PHP version.

On 25 October, researchers at Dream uncovered the artifacts of a campaign that had gained root on 25 servers across the US, Japan, Taiwan and South Korea, including three systems in a US government-affiliated environment. Palo Alto Networks' Unit 42 independently verified the attacker tooling and tracks the activity as CL-UNK-1280, attributing it to a Chinese-speaking operator in the UTC+8 time zone.

The targets in this case were internet-exposed PAN-OS firewall management interfaces (see our PHP2Shell appliances guide for the wider list of devices that run PHP), but the shape of the attack is what every PHP operator should read carefully. It came in two jumps:

Dream puts the full chain at under fifteen minutes per host. Once root, the attacker pulled a directory service account password out of the device configuration and enumerated the domain's users and groups. Private keys, network topology and single sign-on configuration were also exposed. A flaw in a public-facing web runtime ended with an attacker reading the company's user directory. What they found on the device is covered in Your Firewall Isn't a Wall.

Severity scores rate each flaw on its own. Attackers combine them.

Fragnesia was disclosed on 13 May 2026 with a public proof of concept, and most major distributions, including Ubuntu, Red Hat, SUSE, Debian, AlmaLinux and Amazon Linux, shipped fixed kernels. It scores 7.8 and is labelled "local" because it needs an attacker to already be on the box. In a patch queue sorted by score and by "network" versus "local", a 7.8 local kernel bug slips below the critical, remotely exploitable items and sits there for months.

PHP2Shell removes the one precondition that kept Fragnesia in the backlog. The local access a kernel bug needs is exactly what an unauthenticated RCE hands over. On its own, each flaw looked manageable, so each waited its turn. Chained, they took an attacker from the open internet to root and into the domain.

None of this is specific to firewalls or to Fragnesia. Any internet-facing PHP host that was exposed during the PHP2Shell window, running a kernel that is missing a known privilege-escalation fix, has the same two rungs available. The escalation bug could be any unpatched local flaw, not only this one.

Three practical takeaways.

If a host was exposed before you patched, our read-only PHP2Shell Compromise Check (from €290) looks for web shells, new users, SSH keys and scheduled tasks. The manual version is in our guide to the PHP2Shell compromise check and secret rotation.

An external assessment maps what is exposed and how current your runtimes and kernels are. It is the right first step after PHP2Shell, and for many sites it is enough.

Go further when the exposed host can reach something that matters: a directory service, a secrets store, an internal management network. The PHP2Shell cases were dangerous not because one box fell, but because that box sat next to identity infrastructure. If that describes your environment, the question is no longer "is PHP patched" but "what could someone reach from the first host they land on", and that is a question a chained, internal-path test answers rather than a scanner. See internal vs external penetration testing for the difference, or contact us to scope an internal test.