🔍 Read the full analysis: PHP2Shell And Palo Alto: Tracing A Two-Day Escalation To Root on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream reported that an attacker used PHP2Shell and a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, then reached an internal server at a U.S. government-affiliated organization. Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results. Dream found AI tools on the attacker’s servers, but said it has no direct evidence they created the exploits or scripts.
Dream, an Israeli cybersecurity company, says an attacker gained root access to 24 Palo Alto Networks PAN-OS firewalls in an automated campaign on October 23, two days after fixes for the PHP flaws known as PHP2Shell were released. The next day, the attacker used compromised equipment to reach a management server at a U.S. government-affiliated organization; Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results.
Dream’s account describes a chain of three vulnerabilities: the two PHP2Shell flaws, identified as CVE-2026-109618 and CVE-2026-109619, and Fragnesia, a Linux kernel privilege-escalation flaw, CVE-2026-46300, disclosed in May. Dream says PHP2Shell gave the attacker a way to run commands on the firewall’s management web server, while Fragnesia was used to elevate access to root. The attack did not require a password, according to the report.
Dream says the attacker identified roughly 19,000 internet-facing management interfaces, collected version information from about 5,000, and narrowed the list to 240 targets based on location and software version. An automated run attacked those targets five at a time between 18:14 and 21:55 UTC on October 23. Twenty-four firewalls were rooted; Dream says 22 were left with hidden web shells. It reports that two belonged to the government-affiliated organization later targeted from within.
On October 24, according to Dream’s timeline, the attacker compromised a second firewall at that organization, established a route back to the attacker and persistence that survived reboots, then used the connection to take control of an internal firewall management server. Dream counts that server as the 25th compromised system and says the attacker then targeted the organization’s Active Directory, which manages user accounts and access. The source material does not establish the extent of any resulting access to accounts or data.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Internet-Facing Management Put Networks at Risk
The incident shows how a flaw in a firewall’s management software can become a route into the network the device is meant to protect. According to Dream, the PHP flaw initially provided limited access; a separate, publicly disclosed kernel vulnerability then enabled escalation to root privileges. The reported movement from firewalls to an internal management server illustrates the potential consequences when an exposed administrative interface is compromised.
The timing also matters for defenders. PHP published fixes on October 21, but Dream says Palo Alto’s fixes for the affected PAN-OS branches arrived between October 27 and 29. Palo Alto’s October 21 advisory said fixed builds were forthcoming. Until an applicable update was available, the vendor’s stated protection was to keep the management interface off the public internet. The account highlights the practical need to limit exposure, track vendor advisories and investigate devices that may have been accessible during a patching gap.
Dream also found AI-related software on the attacker’s servers, including Claude Code and an offensive-security platform configured with DeepSeek and Kimi. That discovery does not establish that AI produced the exploit chain. Dream says it has no direct evidence that AI tools wrote the exploits or scripts, and says the attack did not appear fully autonomous. The confirmed risk in the report is the combination of known vulnerabilities and exposed management services, not a proven new AI capability.
Products Worth Considering
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Amazon Kindle Scribe Colorsoft 64GB (1st Generation)
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
As an affiliate, we earn on qualifying purchases.
Patches Followed Earlier Kernel Disclosure
Fragnesia, the Linux kernel flaw used in the reported chain, had been disclosed in May 2026 and had a public exploit, according to the source material. PHP released updated versions on October 21 and urged users to update. Palo Alto Networks issued an advisory on the same date, while fixed PAN-OS versions for the affected 12.1 and 12.2 branches were described as upcoming. Dream reports that the relevant fixes shipped from October 27 through October 29.
Dream says its researchers found the attacker’s artifacts on October 25 and published the initial account on October 26, updating it October 29. The U.S. Cybersecurity and Infrastructure Security Agency added both PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26 and set a three-day deadline for federal agencies, according to the supplied account. These dates help explain the short interval between public fixes and the reported campaign, but they do not establish that every targeted device was unpatched or vulnerable in the same way.
““no direct evidence””
— Dream
AI’s Role and Network Impact Remain Unclear
The supplied account does not identify the attacker or explain their motive. Dream found Claude Code, DeepSeek and Kimi-related tools on attacker-controlled systems, but says it cannot directly link those tools to the exploit code or automation. The description of an AI-assisted attack should therefore be treated as an inference, not a confirmed finding about how the vulnerabilities were discovered or used.
The full consequences for the government-affiliated organization are also not specified. Dream says the attacker targeted Active Directory, but the source material does not say whether credentials were obtained, whether broader systems were accessed, or whether information was taken. It is also unclear whether the 22 reported web shells remained active, whether all affected devices have been remediated, or whether other organizations were compromised outside the reported set.
Patch, Isolate and Check for Persistence
Organizations using affected PAN-OS branches should consult Palo Alto Networks’ advisory and apply the fixed release appropriate to their systems. The vendor’s interim guidance, as described in the source material, was to restrict management access from the public internet. Administrators should also assess exposed devices for compromise and review relevant logs and indicators rather than assuming a software update alone removes any existing persistence.
Federal agencies faced a CISA deadline after the PHP2Shell CVEs were added to the exploited-vulnerability catalog. Further information from Palo Alto Networks, Dream, CISA or the affected organization may clarify the scope of remediation and whether attackers accessed data or accounts. Until those details are confirmed, the reported Active Directory targeting should not be treated as proof of a broader breach.
Key Questions
What happened in the PHP2Shell attack?
Dream says an attacker chained two PHP2Shell flaws with the Linux kernel flaw Fragnesia to gain root access on 24 PAN-OS firewalls. The attacker then used compromised firewalls to reach an internal management server at a U.S. government-affiliated organization.
Were the attacks confirmed by Palo Alto Networks?
Palo Alto Networks said its Unit 42 researchers independently verified the attacker’s tools and results. The supplied material does not say the vendor confirmed every detail of Dream’s account or the full impact on the affected organization.
Did AI create the exploit?
That has not been established. Dream found AI-related tools on the attacker’s servers but said it had no direct evidence that they wrote the exploits or scripts. The role of those tools remains uncertain.
What should PAN-OS administrators do?
Administrators should check Palo Alto Networks’ advisory, install the applicable fixed release and restrict management interfaces from public access. They should also investigate potentially exposed systems for signs of existing persistence, since patching does not by itself establish that a device was never compromised.
Source: ThorstenMeyerAI.com
