TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Dream Security reported that attackers used a custom PHP2Shell exploit chained with a Linux kernel privilege-escalation flaw to gain root access on 25 PAN-OS servers across four countries. Recovered artifacts show credential extraction and Active Directory enumeration after the compromises, including activity involving three servers in a U.S. government-affiliated environment. Palo Alto Networks’ Unit 42 verified the tooling and results, and fixed PAN-OS versions are being released.
Dream Security said attackers used a custom PHP2Shell exploit chained with a Linux kernel privilege-escalation flaw to gain root access on 25 Palo Alto Networks PAN-OS servers, including systems in a U.S. government-affiliated environment. The company said the operation then targeted internal identity infrastructure, with recovered artifacts showing credential extraction and Active Directory enumeration; Palo Alto Networks’ Unit 42 independently verified the tooling and results.
Dream said it found artifacts on October 25 that documented the operation, including a custom exploit chain, target lists, exploitation logs and about 40 post-exploitation scripts. The affected systems were located in the United States, Japan, Taiwan and South Korea. Within the U.S. government-affiliated environment, the attackers focused on three servers, according to the research report. The material describes an operation that moved from exploit development in a laboratory setting to persistent access to an organization’s internal Active Directory domain.
The chain paired PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 with the Fragnesia kernel privilege-escalation vulnerability, CVE-2026-46300. Dream said the PHP exploit targeted the PAN-OS management web server, which also fronts the GlobalProtect portal, and could provide unauthenticated code execution on exposed devices running vulnerable builds. The second flaw was used to elevate access to root. Dream described its recovered PHP exploit as a custom, non-public implementation tailored to PAN-OS.
After gaining access, the attacker used the compromised firewalls to target Active Directory, the system many organizations use to manage accounts and access to network resources. Dream reported that recovered artifacts confirm credential extraction and directory enumeration. Palo Alto Networks is releasing fixed PAN-OS versions across affected branches, according to Dream’s October 29 update. The report does not specify in the supplied material how many systems have been patched or whether all targeted organizations have completed incident response.
From Firewall Access to Identity Systems
The reported activity matters because a firewall compromise can provide a route beyond the perimeter device itself. Dream’s artifacts indicate that, after rooting affected servers, the attacker sought information and credentials from Active Directory, potentially widening the consequences for organizations whose internal accounts or systems were exposed. The report identifies a government-affiliated environment among the targets, but does not establish that government data was stolen or that a broader government network was compromised.
The findings also underline why patching is only one part of a response. Organizations need to identify exposed and vulnerable devices, apply the relevant fixes, and investigate whether an attacker used any access to reach identity systems or maintain persistence. Those are defensive implications of the reported chain, not confirmation that every affected organization experienced the same post-compromise activity.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
As an affiliate, we earn on qualifying purchases.
How the Two-Exploit Chain Worked
Dream said the attacker combined a remote-code-execution exploit against the PAN-OS management web server with a separate kernel flaw to move from code execution to root privileges. The report describes the initial exploit as abusing PHP’s session upload-progress handling and memory corruption, while Fragnesia was used for privilege escalation. The two vulnerabilities were chained to reach root access, according to the researchers.
The affected surface is the management web server, which also fronts the GlobalProtect portal. Dream’s October 29 update says its researchers have shared findings and are collaborating on an investigation with Palo Alto Networks, the firewall vendor. The vendor’s Unit 42 team independently verified the attacker’s tooling and results, and Palo Alto Networks is releasing fixes for affected PAN-OS branches. The supplied report does not list the specific vulnerable versions or the full patch schedule.
Dream also found indications of AI-related tools in the attack infrastructure, including Claude Code, an offensive security platform configured with Chinese language models, and API keys for the Chinese reconnaissance service FOFA. The researchers said they had no direct evidence that AI tools wrote the exploit or post-exploitation scripts. They said code structure and consistency across the scripts suggested AI-assisted development, while cautioning that the operation did not appear to be a fully autonomous state-backed attack.
“We have no direct evidence that the AI tools were specifically used to write the exploit or the post-exploitation scripts.”
— Dream Security
Patch Status and Intrusion Scope
The supplied report does not identify the affected PAN-OS versions, provide a complete list of impacted devices, or say how many of the 25 servers remain vulnerable. It also does not establish whether the attackers accessed or removed data beyond the reported credential extraction and directory enumeration, or whether they maintained access after discovery. The scale of any impact to the U.S. government-affiliated organization remains unclear.
Attribution is also unsettled in the material provided. Dream described indicators of possible AI-assisted development and Chinese-related tools in the infrastructure, but said it had no direct evidence those tools created the exploits and did not characterize the operation as a fully autonomous nation-state attack. The report does not name an actor or establish who directed the campaign.
Vendor Fixes and Incident Review
Palo Alto Networks is releasing fixed PAN-OS versions across the affected branches, according to Dream’s October 29 update. Administrators should consult the vendor’s security guidance for affected versions and remediation steps; the source material here does not give a version-by-version patch list. Organizations with exposed management interfaces should also determine whether their devices were vulnerable and investigate for signs of exploitation.
Dream said it is continuing to share information and collaborate with Palo Alto Networks. Further updates may clarify the vulnerable builds, the number of systems affected, the status of fixes and whether investigations found additional access to internal networks. Until those details are published, the confirmed account remains limited to the artifacts Dream reported and the tooling and results Unit 42 independently verified.
Key Questions
What happened to the PAN-OS servers?
Dream Security reported that attackers chained remote code execution and a kernel privilege-escalation flaw to gain root access on 25 PAN-OS servers across the United States, Japan, Taiwan and South Korea.
Were U.S. government systems affected?
Dream said three servers in a U.S. government-affiliated environment were targeted after the broader set of compromises. The report does not establish that government data was stolen or describe the full impact on that organization.
What did the attacker do after gaining root access?
Dream said recovered artifacts confirm credential extraction and Active Directory enumeration. The supplied report does not detail whether data was removed or how far access extended into affected organizations.
Did AI create the exploits?
That has not been confirmed. Dream found AI-related tools and indicators it said were consistent with AI-assisted development, but reported no direct evidence that AI wrote the exploits or scripts.
Are fixes available?
Dream’s October 29 update says Palo Alto Networks is releasing fixed PAN-OS versions across affected branches. The material provided does not list specific versions, so administrators should check the vendor’s current security guidance.
Source: dreamgroup.com
