🔍 Read the full analysis: Two Days After The Patch: Tracing PHP2Shell To Root On Palo Alto Servers on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Dream says an attacker used PHP2Shell alongside a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, then compromised an internal firewall-management server at a US government-affiliated organization. Palo Alto Networks says Unit 42 independently verified the tools and results; Dream says it has no direct evidence that AI tools wrote the exploit.
An attacker gained root access to 24 Palo Alto Networks firewalls in an automated campaign that began about two days after PHP announced fixes for two critical flaws, according to Israeli security company Dream. Dream says the attacker then used compromised firewalls to reach a US government-affiliated network, take over an internal firewall-management server and target Active Directory; Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results.
Dream’s account says the attacker ran an automated batch against 240 selected firewalls on the evening of October 23, rooting 24 of them. The targets were in the United States, Japan, Taiwan and South Korea. Dream says 22 compromised devices were left with a hidden web shell, while two belonged to the government-affiliated organization later targeted from within. The report describes a total of 25 compromised servers: the 24 firewalls and one internal management server.
The reported intrusion combined the two PHP vulnerabilities called PHP2Shell—CVE-2026-109618 and CVE-2026-109619—with Fragnesia, a Linux kernel privilege-escalation flaw disclosed in May as CVE-2026-46300. Dream says the PHP bugs allowed command execution under a low-privilege account on the firewall’s management web server, while the kernel flaw was used to gain administrator-level root access. The report says the attacker’s chain, including installation of a persistent back door, took under 15 minutes.
Dream places the first government-affiliated firewall compromise at 18:14 UTC on October 23. It says the attacker returned the next morning, compromised a second firewall belonging to the organization and used a tunnel to reach its internal firewall-management server at 11:35 UTC on October 24. Dream reports that the attacker then targeted the organization’s Active Directory, which manages user accounts and access. The source material does not specify the outcome or extent of that activity.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
From Firewall Access to Internal Systems
The incident shows how an internet-accessible management interface can turn a flaw in a network device into a route toward an organization’s internal systems. The reported attack moved from vulnerable firewalls to a server used to manage other firewalls, then toward Active Directory. If access to those systems is established, an attacker may be positioned to affect accounts and broader network access; the available report does not establish that the attacker succeeded in taking over Active Directory.
The timing also matters for organizations using affected PAN-OS branches. PHP released fixes on October 21, and Palo Alto Networks issued its advisory that day, but Dream says fixed builds for the attacked 12.1 and 12.2 branches were not released until October 27-29. During that period, the protection identified in the source material was to keep the management interface off the public internet. The account highlights the risk of exposed management services when a patch is announced before a vendor’s affected product builds are available.
Dream found AI-related tools on the attacker’s servers, including Claude Code and the DeepSeek and Kimi models configured in a platform called aiscan. That evidence supports reporting that AI tools were present, not that they created or operated the exploit. Dream says it has no direct evidence that AI wrote the exploit or scripts and says the incident does not appear to have been fully autonomous. The distinction matters: the documented access path involved known software vulnerabilities and exposed management pages, while the role of AI remains unproven.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The Patch and Exploit Timeline
Dream’s timeline says Fragnesia was disclosed in May 2026, with a public exploit, and was fixed in the Linux kernel. On October 21, the PHP project released patched versions of several PHP branches, including 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Palo Alto Networks also published an advisory that day; according to Dream, fixed PAN-OS builds for the affected 12.1 and 12.2 branches followed between October 27 and October 29.
Before the attack, Dream says its researchers identified roughly 19,000 PAN-OS firewalls with management pages exposed to the internet using the FOFA search engine. A custom scanner obtained version information from about 5,000, after which the attacker filtered candidates by country and software version to produce a set of 240 targets. These are figures from Dream’s investigation, not a count of devices confirmed compromised: the report says 24 of the 240 were rooted.
Dream says the attacker had configured the aiscan platform with DeepSeek and Kimi on October 8. Researchers found Claude Code installed as well. The report was published on October 26 and updated October 29. According to the supplied account, the US Cybersecurity and Infrastructure Security Agency added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26 and set a three-day deadline for federal agencies. These milestones establish the reported response timeline, but do not by themselves confirm the full scope of exploitation beyond Dream’s findings.
““no direct evidence””
— Dream
AI Role and Intrusion Scope
The role of AI in the campaign remains unconfirmed. Dream found AI coding and model tools on the attacker’s servers, but says it has no direct evidence they produced the exploit or scripts. The report also does not establish that the attack was autonomous, or show which parts of the operation, if any, were assisted by those tools.
The available account leaves open how many organizations were affected beyond the 24 rooted firewalls and the internal server, whether attackers used the planted web shells after installation, and what happened during the attempts against Active Directory. It does not provide the identity of the attacker or the government-affiliated organization. Palo Alto Networks’ reported independent verification concerns the tools and results; the supplied material does not detail the methods or full scope of that review.
It is also unclear from the source material how many exposed devices remain unpatched or publicly reachable, and whether every affected installation can be identified from the reported scanning. The figures of roughly 19,000 exposed management pages, 5,000 version responses and 240 selected targets describe different stages of Dream’s reported investigation, not a confirmed inventory of vulnerable or compromised systems.
Patch Builds and Network Checks
Organizations running affected PAN-OS versions should consult Palo Alto Networks’ current advisory for the applicable fixed build and mitigation guidance, and restrict management access from the public internet. The supplied report says fixed builds for the attacked 12.1 and 12.2 branches arrived between October 27 and 29; administrators should verify the version installed rather than assume that an advisory or patch announcement means a device is already protected.
Security teams should also review firewall management access and logs for signs of unauthorized access, and check whether internal management servers or identity systems were reached. Because Dream describes persistent access on compromised devices, patching alone may not resolve an intrusion already in progress. Organizations that find indicators of compromise should follow vendor and incident-response guidance to assess affected accounts, systems and network connections.
Further details may come from Palo Alto Networks, Dream, government agencies or affected organizations. Until those are published, the attacker’s identity, the extent of any Active Directory compromise, the number of victims beyond those Dream reported and the practical contribution of AI remain open questions.
Key Questions
What happened in the reported PHP2Shell attack?
Dream says an attacker used PHP2Shell and the Fragnesia Linux kernel flaw to gain root access on 24 Palo Alto firewalls, then reached an internal firewall-management server at a US government-affiliated organization.
Does the report prove AI created the attack?
No. Dream found Claude Code and configured DeepSeek and Kimi models on attacker infrastructure, but says it has no direct evidence that AI wrote the exploit or scripts.
Why did the attack follow the PHP fixes so soon?
PHP announced fixes on October 21, while Dream dates the automated firewall attack to October 23. Dream says fixed PAN-OS builds for the affected 12.1 and 12.2 branches arrived later, between October 27 and 29.
How many systems did Dream report as compromised?
Dream reports root access on 24 firewalls and compromise of one internal firewall-management server, for 25 servers in total. It does not establish that all 240 selected targets or all 19,000 devices with exposed management pages were compromised.
What should administrators do?
Check Palo Alto Networks’ advisory for the relevant fixed PAN-OS build, restrict management interfaces to trusted access, and review logs and connected internal systems for signs of compromise. A patch does not by itself remove persistence if a device was already breached.
Source: ThorstenMeyerAI.com
