🔍 Read the full analysis: A Two-Day Breakdown Of The PHP2Shell Chain And 25 Server Takeovers on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream reported that an attacker used PHP2Shell flaws and a previously disclosed Linux kernel vulnerability to gain root access to 24 PAN-OS firewalls, then reached an internal management server, for 25 affected servers in total. Palo Alto Networks’ Unit 42 says it independently verified the attacker’s tools and results; Dream found AI tools in the attack environment but says it has no direct evidence they created the exploit.
Researchers at Dream say an attacker gained root access to 24 Palo Alto Networks PAN-OS firewalls on October 23, then used two of them to enter a US government-affiliated network and compromise an internal firewall-management server the next day. The account, published October 26 and updated October 29, describes a total of 25 servers taken over through a chain involving PHP2Shell flaws and a Linux kernel vulnerability; Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results.
Dream says the attacker selected 240 internet-accessible firewall management interfaces for an automated operation, attacking five at a time. The report says 24 firewalls were rooted between 18:14 and 21:55 UTC on October 23. The affected targets were in the United States, Japan, Taiwan and South Korea. Dream says 22 of the rooted firewalls were left with a hidden web shell, while two belonged to the US government-affiliated organization later entered by the attacker.
The reported chain combined PHP2Shell, CVE-2026-109618 and CVE-2026-109619, with Fragnesia, a Linux kernel privilege-escalation flaw identified as CVE-2026-46300. Dream says PHP2Shell provided code execution with limited privileges on the firewall; Fragnesia then enabled the attacker to gain root access. On October 24, the attacker used a tunnel through the compromised firewalls to reach the organization’s internal firewall-management server, bringing the reported total to 25. Dream says the attacker then targeted Active Directory, which manages access to accounts and systems.
The timing of available fixes is central to the report. PHP released patched versions on October 21, and Palo Alto Networks issued an advisory that day, but Dream says fixed PAN-OS builds for the affected 12.1 and 12.2 branches arrived from October 27 to 29. Until fixes were available, Palo Alto’s guidance was to keep the management interface off the public internet. Dream estimates the chain from initial access to a persistent root backdoor could take under 15 minutes; that is the researchers’ assessment, not a duration independently established in the supplied account.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Firewall Consoles Raised the Risk
The incident highlights the risk of exposing firewall management pages to the internet, particularly when a device has an unpatched vulnerability and a separate route to higher privileges. A firewall is designed to control network traffic, but its management interface can itself become a route into the network if reachable by an attacker. In this case, Dream says the compromised equipment provided access to an internal server responsible for managing other firewalls.
The reported move toward Active Directory matters because that system governs who can sign in to many organizational services. Dream says the attacker targeted it, but the available account does not establish whether the attacker successfully changed accounts, accessed data, or moved further through the network. The incident therefore signals a serious exposure while leaving the extent of downstream impact unresolved.
For defenders, the immediate operational lesson is not dependent on whether AI helped: restrict management interfaces to trusted networks, apply the relevant vendor fixes, and review exposed devices for signs of persistence. Dream’s report also describes use of a kernel flaw disclosed months earlier, underscoring how known vulnerabilities can remain useful to attackers when affected systems are not patched.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
From PHP Fixes to Firewall Patches
Dream’s account places the attack within a short window after PHP released fixes on October 21. The software bundled with PAN-OS was reportedly PHP 8.0.30, according to Dream. Palo Alto Networks published an advisory the same date, while fixed builds for the affected PAN-OS branches were released later, between October 27 and 29. The report says that leaving management interfaces inaccessible from the public internet was the recommended protection while those builds were pending.
The other part of the chain, Fragnesia, was disclosed in May 2026 and had a public exploit, according to the source material cited by Dream. The attacker is said to have prepared an offensive-security platform called aiscan on October 8. Dream reports finding DeepSeek and Kimi configured in that platform, as well as the coding assistant Claude Code on the attacker’s servers. Those observations establish that AI tools were present in the environment, but not what role they played in the operation.
After finding the attacker’s artifacts on October 25, Dream published its report on October 26. The US Cybersecurity and Infrastructure Security Agency added both PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog that day, according to the source material, and set a three-day deadline for federal agencies. Dream updated its account on October 29.
“It has “no direct evidence” that AI tools wrote the exploit or scripts.”
— Dream
AI Role and Network Impact Unresolved
AI’s contribution has not been established. Dream found Claude Code installed and DeepSeek and Kimi configured in an offensive-security platform, but said it has no direct evidence that AI systems wrote the exploit or scripts. The available reporting does not show whether the tools were used for planning, coding, analysis, or another purpose.
The scope of harm inside the government-affiliated organization is also unclear. Dream says the attacker reached the internal firewall-management server and targeted Active Directory, but the supplied account does not confirm whether the directory was successfully compromised or whether data was accessed or removed. It also does not identify the organization or provide a complete accounting of what information, if any, was affected.
The report describes 240 selected targets and 24 rooted firewalls, but does not establish whether other devices were scanned, attacked, or compromised outside that operation. The source material also does not give a full public accounting of remediation across all affected organizations or the results of their investigations.
Patching and Incident Reviews Continue
Organizations using the affected PAN-OS branches should follow Palo Alto Networks’ security advisory and install the applicable fixed release. Where that has not yet happened, the reported interim safeguard is to remove public access to management interfaces and limit them to trusted networks. Administrators should also investigate devices exposed during the attack window for unauthorized accounts, web shells, unexpected tunnels and other persistence, using vendor guidance and incident-response support.
Federal agencies were given three days after CISA added the PHP2Shell vulnerabilities to its exploited-vulnerability catalog, according to the source material. Further updates from Palo Alto Networks, Dream, CISA and affected organizations may clarify remediation, the extent of any access to Active Directory, and whether investigators found evidence of data theft or additional compromised systems. Those outcomes are not established in the account available as of Dream’s October 29 update.
Key Questions
What does PHP2Shell refer to in this report?
PHP2Shell is the name used for two PHP flaws, CVE-2026-109618 and CVE-2026-109619, that Dream says were part of the chain used against PAN-OS firewalls. The report says they enabled code execution with limited privileges before a separate Linux kernel flaw was used to gain root access.
How many servers were reportedly compromised?
Dream reports 24 firewalls gained root access, followed by an internal firewall-management server in a US government-affiliated network. That makes 25 servers in the reported operation; the account does not establish that no other devices were affected.
Did AI create the exploit?
That has not been confirmed. Dream found AI tools on the attacker’s servers but said it had no direct evidence they wrote the exploit or scripts, and that the operation did not appear fully autonomous.
What should PAN-OS administrators do?
Administrators should apply the fixed PAN-OS release for their branch, following Palo Alto Networks’ advisory. The reported interim protection was to keep the management interface off the public internet; exposed devices should also be checked for signs of compromise.
Was Active Directory successfully compromised?
The report says the attacker targeted Active Directory after reaching the internal management server. The available account does not confirm whether the directory was successfully compromised or whether data was accessed or removed.
Source: ThorstenMeyerAI.com
