🔍 Read the full analysis: The PHP2Shell Chain: Two Days, 25 Palo Alto Servers, And Root Access on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream says an attacker used PHP2Shell and a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, then reached a US government-affiliated network and compromised an internal firewall-management server. Palo Alto’s Unit 42 independently verified the attacker’s tools and results, according to the source report; claims that AI helped build the attack remain unproven.
An attacker rooted 24 Palo Alto Networks firewalls in an automated campaign on October 23, then used compromised equipment to enter a US government-affiliated network and take control of an internal server that manages the organization’s firewalls, according to cybersecurity company Dream. The account describes exploitation beginning about two days after PHP released fixes for the vulnerabilities known as PHP2Shell; Palo Alto Networks’ Unit 42 independently verified the attacker’s tools and results, the report says.
Dream said the attacker targeted 240 firewalls and gained root access—the highest-level administrator privileges—on 24. The targets were in the United States, Japan, Taiwan and South Korea. The attack combined two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with Fragnesia, a Linux kernel privilege-escalation flaw disclosed in May as CVE-2026-46300. Dream says the chain could be completed in under 15 minutes.
According to Dream’s timeline, an initial government-affiliated firewall was compromised on October 23. The attacker returned the next day, compromised a second firewall belonging to the organization and established a tunnel into its network. At 11:35 UTC, the attacker used that route to take over an internal firewall-management server, the 25th compromised server in Dream’s account, then targeted the organization’s Active Directory system, which controls user access. The source does not say whether the attacker successfully altered or extracted directory data.
Dream reported that 22 of the 24 rooted firewalls were left with a hidden web shell, a means of retaining remote access. Palo Alto published an advisory on October 21, but the source says fixed PAN-OS builds for the affected 12.1 and 12.2 branches became available between October 27 and 29. Until fixes were available, Palo Alto’s recommended protection was to keep the management interface inaccessible from the internet.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Internet-Facing Management at Risk
The incident shows how a flaw in a product’s management web server can become a route to control of the underlying device when combined with a separate operating-system weakness. In this case, Dream says PHP2Shell initially allowed commands as a restricted user, while Fragnesia enabled the attacker to escalate privileges to root access. The combination turned an exposed administrative interface into a foothold that could support persistent access and movement into an organization’s internal network.
The reach into a firewall-management server matters because such systems can provide control over multiple security devices. Dream also says the attacker targeted Active Directory, a system central to authentication and permissions. The extent of any resulting access, changes or data theft is not established in the source material, but the sequence shows why exposed management interfaces and unpatched systems can put more than the individual firewall at risk.
The report’s “AI-assisted” framing is less firmly established than the compromise itself. Dream found AI-related tools on the attacker’s servers, but says it has no direct evidence that AI wrote the exploit or attack scripts. The confirmed operational concern is the use of known vulnerabilities against reachable systems, not proof of a new, autonomous attack method.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Ledger Flex + Folio Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
From PHP Fixes to Firewall Patches
PHP released updated versions on October 21 and urged users to update. Dream says Palo Alto firewalls use their own copy of PHP, version 8.0.30, and that the vendor issued an advisory the same day while fixes for the affected PAN-OS branches were still forthcoming. The timing left a period between the PHP project’s release and the availability of the relevant firewall builds.
Dream says its researchers identified roughly 19,000 PAN-OS firewalls with internet-facing management pages using the device-search service FOFA. A custom scanner obtained version information from about 5,000; filtering by country and software version narrowed the attacker’s selected list to 240. These are figures from Dream’s account, not a count of confirmed vulnerable devices worldwide.
The second vulnerability in the chain, Fragnesia, had been publicly disclosed in May with an exploit available, according to Dream’s timeline. The company says the attacker had set up an offensive-security platform called aiscan with DeepSeek and Kimi models on October 8, and researchers found Claude Code installed on the attacker’s servers. Those findings show access to AI tools; they do not establish how, or whether, those tools were used in the intrusions.
““no direct evidence””
— Dream
AI Role and Network Impact
The evidence described by Dream confirms that AI tools were present on the attacker’s servers, but does not establish that AI produced the exploit, selected targets or ran the campaign. Dream said the operation did not appear fully autonomous. The source material provides no direct evidence resolving how the tools were used.
It is also unclear whether the attacker successfully changed Active Directory settings, accessed credentials or data, or moved beyond the systems identified by Dream. The report says the attacker went after Active Directory but does not specify the outcome. The supplied account also does not identify the government-affiliated organization or provide a complete public inventory of affected firewall owners and remediation status.
Dream reports root access on 24 of 240 targeted firewalls, but that figure should not be read as a measure of all vulnerable devices. The source’s estimate of 19,000 internet-exposed management pages and its subsequent scanning figures describe different stages of its search, not a confirmed global tally of exploitable systems.
Patch and Review Exposed Devices
Organizations using the affected PAN-OS branches should consult Palo Alto Networks’ advisory for the appropriate fixed release and verify that exposed management interfaces are no longer reachable from the public internet. The source says updates for the affected 12.1 and 12.2 branches shipped between October 27 and 29; administrators should confirm their own version and patch status rather than assume that an advisory alone means a device is protected.
Because Dream reported hidden web shells and access that could persist through reboots, patching should be accompanied by investigation for signs of compromise. Security teams should review firewall logs, management-server access, unexpected tunnels and account activity, and assess whether credentials or Active Directory settings require response. The source does not provide a universal cleanup procedure or say that every affected organization has completed remediation.
Dream’s report says the US Cybersecurity and Infrastructure Security Agency added both PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26 and gave federal agencies three days to address them. Further public information about the government-affiliated network, the outcome of the Active Directory targeting and the number of organizations that remain affected had not been provided in the supplied material.
Key Questions
What happened in the PHP2Shell attack?
Dream says an attacker used PHP2Shell and the Fragnesia Linux kernel flaw to gain root access on 24 Palo Alto firewalls, then used compromised equipment to reach an internal firewall-management server at a US government-affiliated organization.
How many systems did the attacker compromise?
Dream reports 24 compromised firewalls and one internal management server, for 25 servers in total. It says the attacker targeted 240 firewalls; the source does not establish that all 240 were vulnerable or compromised.
Did AI build or operate the attack?
That has not been proven. Dream found Claude Code and an offensive-security platform configured with DeepSeek and Kimi on the attacker’s servers, but said it had no direct evidence that AI wrote the exploit or scripts.
What should Palo Alto firewall operators do?
Check Palo Alto Networks’ advisory and install the applicable fixed PAN-OS release. Keep management interfaces off the public internet where possible, and investigate for web shells, unusual access or persistence because Dream says some rooted devices were left with hidden access.
Source: ThorstenMeyerAI.com
