🔍 Read the full analysis: The PHP2Shell Chain In Focus: 25 Palo Alto Servers And AI Assistance on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Dream reported that an attacker used PHP2Shell and a separate Linux kernel flaw to gain root access to 24 Palo Alto Networks firewalls, then reached a 25th server on a US government-affiliated network. Palo Alto Networks says Unit 42 independently verified the tools and results. Dream found AI tools in the attacker’s environment but says it has no direct evidence they wrote the exploit or scripts.
An attacker gained root access to 24 Palo Alto Networks firewalls and then reached an internal server on a US government-affiliated network, according to a report by Israeli security company Dream. The campaign followed the October 21 release of fixes for two PHP flaws known as PHP2Shell; Palo Alto Networks said its Unit 42 researchers independently verified the attacker’s tools and results.
Dream says the attacker ran an automated batch against 240 firewalls on October 23, about two days after the PHP fixes became available. The report says 24 devices were compromised with root access. On October 24, the attacker used two firewalls belonging to the same government-affiliated organization to reach an internal firewall-management server, making 25 servers in total. The affected firewalls were in the United States, Japan, Taiwan and South Korea.
The reported chain combined PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 with Fragnesia, a previously disclosed Linux kernel flaw tracked as CVE-2026-46300. Dream says PHP2Shell allowed command execution under a low-privilege account on the firewall, while Fragnesia was then used to gain root. The report says the attacker installed hidden web shells on 22 of the rooted firewalls and established persistence on systems in the government-affiliated network.
Dream also reports that the attacker targeted the organization’s Active Directory, which manages user identities and access. The available source material does not specify what data, if any, was accessed or taken. Dream says the full chain, including installing a persistent root back door, took less than 15 minutes. Palo Alto Networks’ independent verification supports the account of the tools and results, but the incident details cited here come primarily from Dream’s investigation.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Internet-Facing Management Was the Entry Point
The report illustrates how a security appliance can become a route into an organization’s internal systems when its management interface is exposed to the internet. A firewall is meant to control network access, but its administrative functions can create a high-impact target if attackers can reach them and exploit vulnerabilities before a fixed device is deployed.
The attack also shows the risk of chaining flaws. PHP2Shell provided an initial foothold, while the older kernel vulnerability reportedly elevated access to root. A patch for one component did not, on its own, prevent the chain: organizations also needed the relevant PAN-OS fixed builds or to restrict access to the management interface. The reported move from a perimeter device to an internal management server makes the incident relevant beyond firewall administrators, particularly to teams responsible for identity systems and network segmentation.
Dream’s findings about AI tools have attracted attention, but they do not establish that artificial intelligence created the exploit or ran the operation. The immediate defensive lesson in the source account is more concrete: limit public access to management pages, apply vendor fixes, and review exposed systems for signs of compromise.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Apple Watch Series 12 GPS Smartwatch, 46mm
As an affiliate, we earn on qualifying purchases.
Patches Followed a Known Kernel Flaw
PHP released updated versions on October 21, and Palo Alto Networks published an advisory that day. According to the source account, fixed PAN-OS builds for the affected 12.1 and 12.2 branches became available between October 27 and October 29. That left a period between the advisory and the availability of those fixes during which the recommended safeguard was to keep the management page off the public internet.
The second flaw used in the chain, Fragnesia, had been disclosed in May 2026 with a public exploit and a kernel fix, according to Dream’s timeline. Dream says it identified roughly 19,000 PAN-OS firewalls with internet-facing management pages, queried about 5,000 for version information, then narrowed its reported attack set to 240 devices based on country and software version. These figures describe the research and targeting process in Dream’s account, not a count of confirmed compromises.
Dream published its findings on October 26 and updated them on October 29. The US Cybersecurity and Infrastructure Security Agency added both PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26 and gave federal agencies three days to address them, the source says.
““no direct evidence” that AI tools wrote the exploit or scripts”
— Dream
AI Use and Intrusion Impact Remain Unclear
The role of AI is not established. Dream says it found Claude Code installed on the attacker’s servers and found the Chinese models DeepSeek and Kimi configured in a security platform called aiscan. It says it has no direct evidence those tools generated the exploit or scripts. Their presence shows access to AI tools, not how they were used during the attack.
The source material also does not establish whether the attacker accessed or removed information from the government-affiliated organization, how far the Active Directory activity progressed, or whether all compromised devices have been identified and cleaned. It does not name the organization or give a complete account of the incident response. The reported 24 rooted firewalls are distinct from the wider pool of devices Dream found exposed during its research.
Patch, Restrict Access, Investigate
Organizations using affected PAN-OS branches should check Palo Alto Networks’ advisory for applicable fixed versions, apply updates, and keep management interfaces restricted to trusted networks rather than exposing them publicly. Teams should also investigate potentially affected devices for persistence and unauthorized access, with particular attention to firewall-management systems and identity infrastructure.
The next public milestones are further details from Palo Alto Networks, Dream or affected organizations about remediation, the scope of the Active Directory activity, and any confirmed data impact. The source material does not give a deadline for such disclosures. Until more information is released, the confirmed account is that the attacker reportedly rooted 24 firewalls and reached a 25th internal server—not that the full extent of the intrusion is known.
Key Questions
What happened in the PHP2Shell attack?
Dream says an attacker chained two PHP vulnerabilities with a Linux kernel flaw to gain root access to 24 Palo Alto firewalls and reach an internal firewall-management server on a US government-affiliated network.
Were 25 firewalls compromised?
No. Dream’s account describes 24 rooted firewalls and one internal management server, for 25 servers in total.
Did AI write or run the attack?
That is not confirmed. Dream found AI tools on the attacker’s servers but said it had no direct evidence they wrote the exploit or scripts, and said the operation did not appear fully autonomous.
What should Palo Alto firewall administrators do?
Check Palo Alto Networks’ advisory for the applicable fixed PAN-OS version, install the update, and restrict management interfaces to trusted networks. Organizations should also assess potentially exposed systems for signs of compromise.
Is the full impact of the intrusion known?
No. The supplied reporting does not say whether data was taken, how far the Active Directory targeting progressed, or whether every affected device has been found and remediated.
Source: ThorstenMeyerAI.com
