🔍 Read the full analysis: Two Days From Patch To Root: How A PHP2Shell Chain Took Over 25 Palo Alto Servers, And What “AI-Assisted” Really Means on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream reported that an attacker used PHP2Shell vulnerabilities and a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, then compromised an internal management server at a U.S. government-affiliated organization. Palo Alto Networks says Unit 42 independently verified the attacker’s tools and results. Dream found AI tools in the attacker’s environment but said it has no direct evidence they created the exploit.
Researchers say an attacker gained root access to 24 Palo Alto Networks firewalls and used two of them to reach an internal management server at a U.S. government-affiliated organization, in an intrusion reported by Israeli security company Dream. The attacker chained the newly fixed PHP2Shell vulnerabilities with a previously disclosed Linux kernel flaw; Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results.
Dream’s account describes an automated operation on the evening of October 23. The attacker reportedly selected 240 firewalls after scanning and filtering internet-connected devices, then attacked them in batches. Dream says 24 firewalls were rooted, with targets in the United States, Japan, Taiwan and South Korea. The report says 22 were left with hidden web shells, while two belonged to the government-affiliated organization later breached internally.
According to Dream, the attacker first used PHP2Shell, CVE-2026-109618 and CVE-2026-109619, to run code on the firewall’s management web server. A second vulnerability, the Linux kernel flaw Fragnesia, CVE-2026-46300, was then used to gain root privileges. Dream says the chain could reach a persistent root back door in under 15 minutes. These are findings in Dream’s report; the article does not establish that every target had identical exposure or impact.
On October 24, the attacker reportedly used a compromised firewall as a tunnel into the organization’s network, rooted its internal firewall-management server and then targeted Active Directory, which governs access to organizational accounts and systems. Dream counted that server as the 25th compromised system. It reported evidence of attacks against Active Directory but did not specify the extent of any resulting account or data compromise.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Interfaces Enabled Intrusion
The incident illustrates the risk of putting firewall management pages directly on the internet. These interfaces control network security rules, so access to them can provide a route toward sensitive internal infrastructure. In this case, Dream says the attacker moved from vulnerable firewalls to a server used to manage the organization’s firewalls and then targeted Active Directory.
The timing also highlights the gap between an advisory and an available fix. Palo Alto issued an advisory on October 21, but Dream says fixed builds for the affected PAN-OS 12.1 and 12.2 branches were released from October 27 to 29. Until those builds were available, Palo Alto’s guidance was to keep management interfaces off the internet. For operators, limiting exposure and applying the relevant updates are practical defenses against this reported chain.
Dream found the Claude Code assistant and the DeepSeek and Kimi models configured in an offensive-security platform on the attacker’s infrastructure. But the company said it had no direct evidence that AI wrote the exploit or scripts, and that the activity did not appear fully autonomous. The evidence supports reporting AI tools in the environment, not attributing the operation’s success to AI.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
As an affiliate, we earn on qualifying purchases.
Fixes Followed the October 21 Advisory
The PHP project released security updates on October 21, including fixes relevant to the two PHP2Shell vulnerabilities. Palo Alto published an advisory that day, but its own PAN-OS software includes a PHP component, and according to Dream, patched firewall builds were not released until several days later. The interval left organizations relying on interim measures, including restricting access to management interfaces.
The second vulnerability in the chain was not new. Fragnesia was disclosed in May 2026, with a public exploit and a kernel fix, according to the supplied reporting. Dream’s timeline says the attacker identified roughly 19,000 PAN-OS firewalls with internet-facing management pages, obtained version information for about 5,000, then narrowed the list to 240 targets. Those figures describe the reported scanning and selection process, not the number of devices confirmed vulnerable or compromised.
Dream found artifacts associated with the attack on October 25 and published its account on October 26, updating it on October 29. The U.S. Cybersecurity and Infrastructure Security Agency added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26 and set a three-day remediation deadline for federal agencies, according to the source material.
““No direct evidence” indicates that AI tools wrote the exploit or scripts.”
— Dream
AI’s Role and Damage Remain Unclear
The reported compromises do not establish the full extent of the organization’s losses. Dream says the attacker went after Active Directory, but the supplied material does not say whether accounts were successfully taken over, what information may have been accessed, or whether the attacker maintained access beyond the documented back doors.
The role of AI also remains uncertain. Dream found Claude Code installed and DeepSeek and Kimi configured in aiscan, but said it had no direct evidence those tools produced the exploit or attack scripts. Their presence alone does not show when or how they were used. The available account also does not identify the attacker or establish a motive.
The report gives counts for the scan and attack, but the comparison basis for the roughly 19,000 discovered devices is not fully described here. It is therefore not possible to infer how many PAN-OS firewalls overall were exposed, vulnerable or affected. Palo Alto’s independent verification supports the reported tools and results, but does not resolve those broader questions.
Patch Builds and Incident Reviews
Organizations using affected PAN-OS versions should consult Palo Alto Networks’ current security advisory, apply the fixed builds available for their release branch and restrict management access to trusted networks. Operators should also investigate exposed management interfaces and review systems for unauthorized persistence or access, following guidance from their security teams and the vendor.
Federal agencies were given three days after CISA’s October 26 catalog action to address the listed vulnerabilities. Further clarity will depend on updates from Dream, Palo Alto Networks and the affected organization, particularly about the reach of the Active Directory activity and whether any accounts or data were accessed. The supplied source material does not describe a later public incident update.
Key Questions
What are PHP2Shell and Fragnesia?
PHP2Shell refers to two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that Dream says allowed code execution on affected firewall management servers. The attacker reportedly chained them with Fragnesia, a Linux kernel privilege-escalation flaw, to gain root access.
How many systems were reportedly compromised?
Dream reported 24 rooted firewalls and one internal firewall-management server, for 25 systems in total. The figures are from the company’s incident account; the report does not establish a broader count of affected devices.
Did AI create the attack?
That has not been established. Dream found AI-related tools and model configurations on the attacker’s infrastructure, but said it had no direct evidence that AI wrote the exploit or scripts.
What should PAN-OS administrators do?
Check Palo Alto Networks’ advisory for the affected release branch, install the applicable fixed build and keep management interfaces off the public internet. Organizations should also investigate potentially exposed devices and follow vendor guidance.
Source: ThorstenMeyerAI.com
