🔍 Read the full analysis: How 25 Palo Alto Servers Fell To A PHP2Shell Chain In Two Days on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Dream says an attacker used PHP2Shell and a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, then reached a 25th server on a U.S. government-affiliated network. Palo Alto Networks’ Unit 42 said it independently verified the attacker’s tools and results. Dream found AI tools on the attacker’s servers but said it has no direct evidence they were used to write the attack.
An attacker gained root access to 24 Palo Alto Networks firewalls and then compromised a 25th server inside a U.S. government-affiliated network, according to security company Dream. The campaign began on October 23, about two days after fixes for the PHP flaws called PHP2Shell were released; Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results.
Dream’s account says the attacker combined two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with Fragnesia, a Linux kernel privilege-escalation vulnerability identified as CVE-2026-46300. PHP2Shell provided a way to run commands on the firewall’s management web server as a low-privilege user. Dream says Fragnesia then allowed the attacker to obtain administrator-level, or root, access.
Dream reports that the attacker identified roughly 19,000 internet-facing PAN-OS management pages, used a custom scanner to obtain version information from about 5,000, and narrowed the selection to 240 targets. An automated batch ran against those targets on October 23, attacking five at a time. Twenty-four firewalls were rooted; 22 were left with a hidden web shell, according to Dream. The targets were in the United States, Japan, Taiwan and South Korea.
On October 24, the attacker reportedly compromised another firewall belonging to the government-affiliated organization, established a tunnel and reached an internal firewall-management server at 11:35 UTC. Dream counts that machine as the 25th compromised server. The attacker then targeted the organization’s Active Directory, which controls access to user accounts and systems. The source report does not say whether those attempts succeeded.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Firewall Management Enabled Access
The report highlights the risk of exposing firewall management interfaces to the public internet. These pages are used to change security rules and administer devices; if an attacker can reach them, a software flaw can become a route into systems behind the firewall. Dream says the attacker’s chain could reach root access in under 15 minutes, though that timing is the company’s assessment rather than an independently detailed measurement in the supplied material.
The reported move from perimeter devices to an internal management server shows why a firewall compromise can affect more than one appliance. Control of a central management system may give an intruder a path to broader network access. Dream also says the attacker went after Active Directory, making the incident relevant to organizations that rely on centralized identity systems. The outcome of those attempts remains unreported.
The AI angle requires restraint. Dream found Claude Code installed and the models DeepSeek and Kimi configured in an offensive-security platform called aiscan. But the company said it had no direct evidence that AI wrote the exploit or scripts, and said the activity did not appear fully autonomous. The evidence supports the presence of AI tools on attacker infrastructure, not a conclusion that AI created or independently carried out the campaign.
Products Worth Considering
FLEXISPOT Standing Desk with Monitor Riser & Cable Management
Samsung Essential S3 27-Inch Curved FHD Monitor
Samsung 34-Inch ViewFinity S50GC Ultra-WQHD Monitor
As an affiliate, we earn on qualifying purchases.
Patch Timing and the Attack Chain
Fragnesia was disclosed in May 2026, according to the source report, and had a public exploit. That gave the attacker a previously known kernel flaw to pair with PHP vulnerabilities. PHP released updated versions on October 21. Palo Alto Networks also published an advisory that day, but, according to the source material, fixed PAN-OS builds for the affected 12.1 and 12.2 branches were released between October 27 and 29—after the reported attacks.
The timing matters because a PHP release does not automatically update the separate PHP copy packaged with a firewall. Dream says the affected PAN-OS devices used PHP 8.0.30, while Palo Alto’s advisory described PAN-OS fixes as forthcoming on October 21. Until patched builds were available, the source identifies limiting access to management pages—keeping them off the internet—as the protective measure. CISA added both PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26 and set a three-day deadline for federal agencies, according to the report.
““no direct evidence””
— Dream
AI Use and Network Impact Unclear
The available account does not establish whether AI tools generated any part of the exploit, selected targets, or automated the intrusion. Dream found the tools and model configurations on attacker-controlled servers, but explicitly said it lacked direct evidence connecting them to the code or scripts used. The attacker’s identity and motive are also not established in the supplied material.
It is not clear whether the attacker successfully accessed or altered Active Directory, what information may have been viewed or taken, or whether any affected organization experienced operational disruption. Dream describes 22 firewalls as left with hidden web shells, but the source does not say whether all persistence mechanisms were removed or whether every affected system was fully restored. Palo Alto’s independent verification is reported, but the underlying evidence and scope of that review are not detailed here.
Patch, Restrict Access, Investigate
Organizations using affected PAN-OS branches should consult Palo Alto Networks’ current advisories and apply the fixed releases available for their version, while restricting management interfaces to trusted networks rather than the public internet. CISA’s addition of the PHP2Shell flaws to its exploited-vulnerability catalog places them on the federal remediation schedule described in the source report. Security teams should also review firewall and identity-system logs for signs of unauthorized access, and investigate systems that may have been reachable from compromised devices.
Further public findings are needed to clarify the extent of the Active Directory activity, any data access, and whether the reported back doors remained on affected networks. The supplied material does not identify a later incident update or a final accounting of remediation. The next clear milestones are vendor and victim-side disclosures about patching, forensic review and the status of the compromised systems.
Key Questions
What happened in the PHP2Shell attack?
Dream says an attacker chained two PHP vulnerabilities with the Fragnesia Linux kernel flaw to gain root access on 24 PAN-OS firewalls, then reached an internal management server on a government-affiliated network.
Were 25 firewalls compromised?
No. Dream’s count is 24 firewalls plus one internal server, for 25 compromised servers in total.
Did artificial intelligence write the attack?
That has not been established. Dream found AI-related tools and model configurations on the attacker’s servers but said it had no direct evidence that they wrote the exploit or scripts.
What did the attacker target after the firewalls?
Dream says the attacker reached the organization’s internal firewall-management server and then targeted Active Directory. The report does not confirm whether those later attempts succeeded.
What should PAN-OS users do?
Check Palo Alto Networks’ advisories for the relevant fixed release, apply updates, and keep firewall management interfaces off the public internet. Organizations should also investigate logs and systems for signs of compromise.
Source: ThorstenMeyerAI.com
