PHP2Shell Roots 24 Palo Alto Firewalls Through Exposed Admin Pages

A week after PHP’s emergency patches, the clearest PHP2Shell success story isn’t a website: it’s Palo Alto Networks firewalls. In a new roundup, Hunt.io pulls together honeypot shells, open-directory attacker kits and Dream Research’s report of an operator who used PHP2Shell plus a Linux kernel bug to root 24 internet-facing PAN-OS firewalls, then pushed into a U.S. government-affiliated network. Most web servers, by contrast, are still beating the exploit, since it depends heavily on how PHP is built and configured.

162.35.99[.]94
15.204.59[.]70
2.59.133[.]151
85.121.179[.]129
130.94.67[.]235
45.83.180[.]113
185.242.106[.]140
45.39.190[.]176

/tmp/.s2 (dropper)
apache2 or php-fpm spawning /bin/sh
Markers: attacksessionid0001, __PHP2SHELL_PROBE, php2shell-scan
Multipart boundaries: —-lf, —-rceStock

Source article: PHP2Shell One Week Later: Honeypot Shells on the Web, a Path to Root on Palo Alto Firewalls
Publisher: Hunt.io
Published: October 30, 2026
URL: https://hunt.io/blog/php2shell-honeypot-shells-root-palo-alto-firewalls

Executive Summary

PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two CVSS 9.2 use-after-free flaws in PHP reachable through the default-on session.upload_progress feature, fixed on Oct. 21, 2026 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 and listed in CISA’s KEV catalog since Oct. 26; a third PHP issue, CVE-2026-115560, was opened on Oct. 23 without technical detail. Hunt.io’s one-week review names no threat actor: it groups infrastructure into unnamed operator clusters by shared files and hashes, and treats the handles ikow, LordX and Tr0y as authors of public proof-of-concept code and a reused log cleaner, not as attribution. On the web, the confirmed successes are honeypots: 0x4D31 logged 32 shells from 162.35.99[.]94 and three from 15.204.59[.]70, and GreyNoise logged five from 2.59.133[.]151, each time an Apache worker spawning sh that ran curl to an integer-encoded attacker IP, while Wiz and CrowdStrike saw no successful production exploitation. The confirmed production compromise, reported by Dream Research and summarized by Hunt.io, targets Palo Alto Networks PAN-OS: an operator using an AI framework (“aiscan”, DeepSeek with Kimi and FOFA) scanned about 19,000 exposed management interfaces, fingerprinted about 5,000, selected 240, and used a custom non-public PHP2Shell exploit against the appweb management server’s PHP 8.0.30 build for unauthenticated code execution, then the Fragnesia kernel flaw CVE-2026-46300 for root, rooting 24 firewalls before opening a persistent reverse SSH tunnel into a U.S. government-affiliated network and compromising an internal firewall management server, 25 systems in total. Exploitation abuses multipart uploads to plant data in session files, grooms the heap, leaks the libphp base to defeat ASLR and forges a destructor pointer to reach system(); one kit carried a utmp/wtmp cleaner. The objective appears to be access to government, finance and telecom networks, with staged targets in Africa, Europe, East and Southeast Asia and the Caucasus that are not confirmed compromises. Hunt leads, false positive expectations and indicators are detailed below; the source publishes no YARA, Sigma or Snort rules.

ATT&CK chain: Reconnaissance → Resource Development → Initial Access → Execution → Privilege Escalation → Defense Evasion → Command and Control

Hunt Lead Grid

PHP2Shell Shell-Source and Staging Infrastructure Sweep

Hunt.io lists three confirmed shell sources: 162.35.99[.]94 (AS19318, Interserver, US; 32 honeypot shells, also seen with a Metabase/H2 gadget and the path metabase-rce-139.162.86[.]33 on port 8090), 15.204.59[.]70 (AS16276, OVH, US; three shells, plus a post-exploitation open directory on port 81) and 2.59.133[.]151 (AS58212, dataforest GmbH, DE; five shells on Oct. 28 and 29). Staging and exploit-development hosts include 208.115.245[.]98, .99 and .102 on port 8088, 185.242.106[.]140:8000, 45.39.190[.]176:8000, 130.94.67[.]235 on ports 80 and 8080 (a repackaged PAN-OS kit), 45.83.180[.]113:19001 (a kit tracker), 85.121.179[.]129 on ports 53, 80 and 443 (first captured Oct. 26), a shared “9bie” kit on 34.146.20[.]31:8181, 38.60.136[.]217:8111, 96.126.130[.]81:9999 and 101.133.233[.]159:8080, plus 130.12.180[.]89:8000, 198.41.83[.]165:8000, 198.41.83[.]174:8000, 18.136.195[.]202:8888, 95.41.54[.]130 (the AI framework workstation), 144.217.161[.]236, 152.42.245[.]8 and 23.27.25[.]75; 45.225.135[.]53 is a scanner only. The honeypot shells called back to an integer-encoded address, 265042758:81 with path /b. The detection logic is a retrospective match of these IPs in web access, firewall, NetFlow and WAF logs, inbound and outbound, with outbound connections from web servers or firewalls weighted far higher than inbound scans.

Sweep from Oct. 17, 2026, a few days before disclosure, since exploitation began before the patches. Inbound hits from the scanner-only and staging hosts show targeting, not compromise; an outbound connection from a PHP server or a PAN-OS device to any of them, or to the integer-encoded callback, should be treated as a successful exploit and escalated. Several addresses sit on large hosting providers (OVH, DigitalOcean, AWS), so do not block whole provider ranges; block the exact IPs. Expect the list to age quickly as kits move, which is why the behavioral leads below matter more.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Initial Access → T1190 (Exploit Public-Facing Application); Command and Control → T1105 (Ingress Tool Transfer)

Sources: “PHP2Shell One Week Later: Honeypot Shells on the Web, a Path to Root on Palo Alto Firewalls”, Hunt.io, Oct. 30, 2026, https://hunt.io/blog/php2shell-honeypot-shells-root-palo-alto-firewalls (source article)

PHP2Shell Kit Markers in Session and Upload Files

The exploit plants attacker data in PHP session files through multipart uploads that abuse session.upload_progress, and one alternative path writes PHP into the session file and includes it through a local file inclusion bug (the kit’s chain_a_session_lfi.py). Hunt.io recommends hunting for three marker strings the public and shared kits leave behind: attacksessionid0001, __PHP2SHELL_PROBE and php2shell-scan. One kit also used /tmp/.s2 as its dropper path, and lab runs wrote proof files to /tmp/x. The detection logic is a string scan of PHP’s session save path, upload temp directories, web server temp folders and /tmp for the three markers, plus a file check for /tmp/.s2.

Run it with any file-content scanner, an EDR file search or a simple scheduled grep across servers that run PHP, and on PAN-OS devices through support or forensic collection where available. Session files are short-lived, so schedule the scan rather than running it once, and also search web server error logs, which often record failed exploit attempts as out-of-memory errors. Hunt.io describes these as markers for a YARA scan but publishes no rule text, so build only the plain string match and do not treat this report as a source of rule content. A marker proves an exploit attempt reached the server; whether it succeeded depends on the shell and network leads below. Your own vulnerability scanners may use similar probe strings, so allowlist them by source IP.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Initial Access → T1190 (Exploit Public-Facing Application)

Sources: Hunt.io, Oct. 30, 2026 (source article)

Upload-Progress Multipart Abuse in Web Logs

Hunt.io’s request-level indicators describe how the exploit traffic looks on the wire: multipart POSTs with no User-Agent header, multipart boundaries shorter than about 12 characters, the specific boundaries ----lf and ----rceStock, an oversized PHPSESSID cookie, and a repeating 10-character name_len pattern in the upload-progress field. Because the exploit has to groom the heap and often fails on memory exhaustion, attackers send it repeatedly; Hunt.io suggests correlating more than three multipart POSTs to the same PHP endpoint from one source within 60 seconds. The detection logic is a WAF or SIEM rule on those request traits, raised in severity when the burst is followed by PHP out-of-memory errors in the server’s error log.

Use WAF logs or web access logs with request headers recorded (default access logs usually lack the boundary and cookie length), plus PHP and web server error logs. Sweep 30 days and keep the rule live. Scope out known upload endpoints by path, but keep the missing-User-Agent and kit-boundary conditions active everywhere, since normal browsers always send both. Setting session.upload_progress.enabled = 0 is the documented mitigation when patching has to wait. Blocking by boundary string alone is the wrong control, since it is trivial for an operator to change; combine it with the burst and size conditions. A burst followed by a shell-spawn alert from the next lead is a confirmed compromise.

Hunt Lead Level: 2 (Pro)

ATT&CK: Initial Access → T1190 (Exploit Public-Facing Application)

Sources: Hunt.io, Oct. 30, 2026 (source article)

Web Worker Spawning a Shell or Calling a Raw IP

Every confirmed honeypot shell followed the same sequence: the Apache worker process spawned /bin/sh, which ran curl to the attacker’s IP written as a single integer (for example 265042758:81/b), then sleep 5. One operator’s kit returned command output inside HTTP responses, so there may be no separate C2 channel at all. The detection logic is a process rule for apache2, httpd or php-fpm spawning sh, bash or dash, combined with a network rule for those processes or their children opening outbound connections to a raw IP address, including integer-encoded or hex-encoded forms, with no TLS SNI.

Use auditd execve rules or Linux EDR process telemetry for the parent-child chain, and EDR network events or egress firewall logs for the connection. Sweep 30 days and keep it running. Some applications legitimately shell out (ImageMagick, sendmail, backup wrappers), so allowlist those exact command lines per host rather than allowing the web user to spawn shells in general. Web servers rarely need outbound connections to arbitrary IPs, so default-deny egress from web tiers is a strong control that also stops the callback. Because the exploit returns output in-band on some kits, absence of a callback does not mean safety; the spawn alone should open an incident. This detection generalizes to almost every web RCE, not just PHP2Shell.

Hunt Lead Level: 2 (Pro)

ATT&CK: Execution → T1059.004 (Command and Scripting Interpreter: Unix Shell); Command and Control → T1105 (Ingress Tool Transfer)

Sources: Hunt.io, Oct. 30, 2026 (source article)

PAN-OS Management Plane Root and Reverse SSH

According to Dream Research’s report as summarized by Hunt.io, the operator discovered about 19,000 internet-facing PAN-OS management interfaces through FOFA, fingerprinted about 5,000 and narrowed to 240 targets, then used a custom PHP2Shell exploit with version-specific offsets against the appweb management server, which runs PHP 8.0.30 on unpatched devices, for unauthenticated code execution, and the Fragnesia kernel flaw CVE-2026-46300 for root. After rooting 24 firewalls, the operator prioritized a U.S. government-affiliated environment, established a persistent reverse SSH tunnel into its internal network and compromised an internal firewall management server; one kit in the same ecosystem carried vcsu7, a utmp/wtmp log cleaner. The detection logic joins three things per firewall: its management interface reachable from the internet (from external attack-surface scans or your own exposure inventory), inbound HTTPS to that interface from sources outside the approved admin list, especially with the multipart traits above, and afterwards any outbound SSH session initiated by the firewall’s management plane to an external host, or any management-plane connection to an internal management server that doesn’t match the normal admin pattern.

This needs firewall traffic and system logs forwarded to a SIEM (management-plane logs, not only data-plane traffic logs), an external exposure inventory, and an allowlist of admin source networks, HA peers and management servers. Sweep from Oct. 17, 2026. Expect noise from administrators connecting from new locations and from legitimate update and logging connections; allowlist by destination and service, not by device. Because the attacker had root and a log cleaner, missing or truncated login records on the device are themselves a signal, and the device’s own logs can’t be trusted to clear it; rely on the SIEM copy and network evidence. Restricting management access to a dedicated network and applying Palo Alto’s updates is the right control; a WAF signature alone is the wrong one, since this operator’s exploit is custom. Any firewall that was exposed and shows outbound SSH it shouldn’t should be treated as compromised: rebuild it from known-good media, rotate every credential it stored, and investigate what the tunnel reached.

Hunt Lead Level: 3 (Elite)

ATT&CK: Initial Access → T1190 (Exploit Public-Facing Application); Privilege Escalation → T1068 (Exploitation for Privilege Escalation); Command and Control → T1572 (Protocol Tunneling); Defense Evasion → T1070 (Indicator Removal)

Sources: Hunt.io, Oct. 30, 2026 (source article); “Chained PHP2Shell Exploit Roots 25 Servers”, Dream Research, https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers (additional source, same campaign, linked by the source article)

Hash Appendix

PHP2Shell attacker kits from open directories

SHA-256 values come from the source article; it publishes no MD5 or SHA-1 values, and AlienVault OTX and VirusTotal were not queried in this run. These are attacker tools found on staging servers, not files expected on victim web servers, so they are most useful for hunting your own file shares, jump hosts and any compromised firewall.

MD5s
(not available)  # poc.py -> murrez PHP2Shell proof of concept
(not available)  # vcript.py / chain_a_session_lfi.py -> shared session-LFI exploit
(not available)  # sc.py -> heap RCE exploit
(not available)  # python.py -> PHP2Shell scanner
(not available)  # panos_rce_poc.py -> PAN-OS exploit script
(not available)  # README.md -> zr0n PHP2Shell kit readme
(not available)  # poc.sql -> file from 162.35.99[.]94 open directory
(not available)  # exploit.py -> shared 9bie exploit
(not available)  # aslr_run.py -> 9bie ASLR bypass runner

SHA1s
(not available)  # poc.py -> murrez PHP2Shell proof of concept
(not available)  # vcript.py / chain_a_session_lfi.py -> shared session-LFI exploit
(not available)  # sc.py -> heap RCE exploit
(not available)  # python.py -> PHP2Shell scanner
(not available)  # panos_rce_poc.py -> PAN-OS exploit script
(not available)  # README.md -> zr0n PHP2Shell kit readme
(not available)  # poc.sql -> file from 162.35.99[.]94 open directory
(not available)  # exploit.py -> shared 9bie exploit
(not available)  # aslr_run.py -> 9bie ASLR bypass runner

SHA256s
535b9e298defd3449ba2b10b9828925d3ce344872dcbd9470c0e8db20f0aae83  # poc.py -> murrez PHP2Shell proof of concept
6f84cc354b785157983efa8f4b674d2e1d6c3331017f29ff8d51bc43668d4b0f  # vcript.py / chain_a_session_lfi.py -> shared session-LFI exploit
2d692ee6dcb41c249c55881897b7dec0550b92963e07fccdb11ad655601977c3  # sc.py -> heap RCE exploit
66bcbc8c2b9d847a1e976e57972e10eac98e9b894cbf30510bff1e8d63efb81f  # python.py -> PHP2Shell scanner
1c93ea48fa7ff886a6d81e44869dd7962309e95d01c1561df362b0b18007a562  # panos_rce_poc.py -> PAN-OS exploit script
9c15dc5a510bf2e8a16c846e61fa35c50ef733b72d4e47b6e8307498a398443c  # README.md -> zr0n PHP2Shell kit readme
4a1502affa36d106d5374bf02cf777956eef651176ec8964b26ff90f103dd506  # poc.sql -> file from 162.35.99[.]94 open directory
c1e81cfbaf7e4cccad7d7f43c1a624b791ba1b7f1d176e224455138604837b4c  # exploit.py -> shared 9bie exploit
5e99d6023dce9bb18d845a37fcdbc7ea574fdb20ab8d888ec54c695382d46036  # aslr_run.py -> 9bie ASLR bypass runner

References Appendix

• “PHP2Shell One Week Later: Honeypot Shells on the Web, a Path to Root on Palo Alto Firewalls”, Hunt.io, Oct. 30, 2026, https://hunt.io/blog/php2shell-honeypot-shells-root-palo-alto-firewalls (source article; honeypot and kit infrastructure, request and host indicators, hashes, recommendations)
• “Chained PHP2Shell Exploit Roots 25 Servers”, Dream Research, Oct. 2026 (updated Oct. 29), https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers (additional source; PAN-OS campaign, as summarized by the source article)
• “Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619”, Unit 42, Palo Alto Networks, https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/ (additional source; vendor guidance)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/