Vulnerabilities · Threat Intelligence
Chinese group exploited chained flaws to access US government servers
A suspected Chinese threat actor used two linked vulnerabilities to gain root access to US government firewall servers, exposing credentials and network settings. The full impact is still unclear, and only one source has reported the incident so far.
Ross GrantUpdated 2 min read
The short version
Researchers say a group linked to China used two software flaws together to break into US government firewall servers. They got full control over some servers, including one that managed all the firewalls for a government organisation. This could have exposed important passwords and network settings. The full impact is not yet clear, and only one report has covered it so far.
By the numbers
- 19,000internet-facing Palo Alto Networks firewalls scannedInfosecurity Magazine
- 240firewalls targeted in US, Japan, Taiwan and South KoreaInfosecurity Magazine
- 24firewalls successfully compromisedInfosecurity Magazine
- 3US government servers compromisedInfosecurity Magazine
What happened?
A suspected Chinese threat actor used two linked exploits to gain root access to US government firewall servers, according to Infosecurity Magazine. The attackers compromised at least three servers, including one that managed all of a government organisation’s firewalls. The full extent of the data accessed is unclear, and only one outlet has reported the incident so far.
How the attack worked
According to Infosecurity Magazine (opens in a new tab), researchers at Dream found that a suspected Chinese-nexus group targeted Palo Alto Networks firewall servers using a chained exploit. The attackers first exploited a flaw in PHP's session.upload_progress mechanism on the firewall's management web server. This was combined with a second vulnerability in the Linux kernel's XFRM ESP-in-TCP subsystem, known as Fragnesia (CVE-2026-46300). By chaining these two exploits, the attackers could overwrite authentication rules and gain root access to the device without a password. Dream reported that both exploits could be executed in a single HTTPS request, giving the attacker a persistent webshell in under 15 minutes.
The attackers scanned about 19,000 internet-facing Palo Alto Networks firewalls worldwide, narrowing their focus to devices running PAN-OS 12.1 and 12.2 with PHP 8.0.30. They identified 240 targets in the US, Japan, Taiwan and South Korea. Using an automated tool, they attempted to exploit these firewalls in batches.
Who is affected
Of the 240 targeted firewalls, 24 were successfully compromised. For most, the attackers only planted a webshell and did not take further action. However, two firewalls belonged to a US government-affiliated environment. On these, the attackers established persistent access, including setting up an 8-port reverse SSH tunnel to their own infrastructure. They then used this access to compromise a third government server, which centrally managed all of the organisation’s firewalls. This gave the attackers access to every managed firewall's configuration, credentials and network settings.
What was taken
By compromising the central management server, the attackers could access firewall configurations, credentials and network settings. The server was also connected to Active Directory, which could have allowed the attackers to steal more credentials. However, the researchers could not confirm whether the attackers succeeded in password spraying, creating backdoor accounts or extracting SAML keys. If these attacks worked, the compromise could extend beyond the firewalls to the organisation’s identity infrastructure.
The response
There is no information yet on how the affected organisations or authorities have responded. The full extent of the data accessed or stolen is still unknown. Only Infosecurity Magazine has reported this incident so far, and no primary sources have confirmed the details.
What you should do
Dream's researchers emphasise the importance of identifying exposed systems and acting quickly to patch vulnerabilities, especially when attackers use chained exploits. Defenders should review exposed firewall management interfaces, update to patched versions where available, and monitor for signs of unauthorised access or webshells. Regularly reviewing authentication logs and firewall configurations can help spot suspicious changes.
Why it matters
This attack shows how chaining two vulnerabilities can give attackers deep access to sensitive government systems. It highlights the risks of exposed firewall management interfaces and the need for quick patching. The lack of confirmation from primary sources means the full impact is still unknown.
Key points
- Attackers chained two vulnerabilities to gain root access to firewall servers.
- At least three US government servers were compromised, including a central management server.
- Access to firewall configurations and credentials could allow wider compromise.
- The full extent of data theft is unclear and only one source has reported the incident.
- Defenders should review exposed systems and patch quickly against chained exploits.
Sources
Infosecurity Magazine
Reference
- Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit (opens in a new tab)
infosecurity-magazine.com
- Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit (opens in a new tab)
