🔍 Read the full analysis: From Patch To Root In 48 Hours: The PHP2Shell Palo Alto Attack on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Dream reported that an attacker used PHP2Shell and a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, then reached a firewall management server inside a U.S. government-affiliated organization. Palo Alto Networks’ Unit 42 says it independently verified the attacker’s tools and results. Dream found AI tools on the attacker’s servers but says it has no direct evidence they created the exploit.
An attacker rooted 24 Palo Alto Networks firewalls and used access to one U.S. government-affiliated organization to compromise an internal firewall management server, according to a report by Israeli security company Dream. The attacks began about two days after PHP released fixes for the flaws Dream calls PHP2Shell; Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results.
Dream’s account, published October 26 and updated October 29, says the attacker ran an automated campaign against 240 firewalls on October 23 and gained root access on 24. The targets were in the United States, Japan, Taiwan and South Korea. Dream reports that 22 of the rooted firewalls were left with a hidden web shell, while two belonged to a U.S. government-affiliated organization.
According to Dream, the attacker chained PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 with Fragnesia, a Linux kernel privilege-escalation vulnerability, CVE-2026-46300, disclosed in May. Dream says PHP2Shell enabled command execution on the firewall’s management web server, while Fragnesia was used to gain root privileges. This is Dream’s description of the attack chain; the report does not establish that every technical detail has been independently confirmed publicly.
Dream says that on October 24 the attacker used a second compromised firewall to reach an internal server managing the organization’s firewalls, bringing the reported total to 25 compromised servers. The attacker then targeted Active Directory, the organization’s system for managing logins and access. Dream also found Claude Code installed and DeepSeek and Kimi configured in an offensive-security platform on the attacker’s servers, but says it has no direct evidence those AI tools wrote the exploit or scripts.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Interfaces Raised the Risk
The report highlights the risk of exposing firewall management pages to the public internet, particularly when a product’s software includes components that need their own security updates. A firewall is meant to control network access; access to its management interface can instead give an attacker a route to change security settings and establish persistence.
The reported move from an internet-facing firewall to an internal management server matters because that server could provide a foothold for access to other devices and systems. Dream says the attacker also targeted Active Directory, which governs accounts and permissions. The report does not say whether the attacker succeeded in taking control of Active Directory or what data, if any, was accessed.
The timing also shows why patch status needs to be checked against the affected product, not just the underlying component. PHP released fixes on October 21, but Dream says Palo Alto’s fixes for the affected PAN-OS branches arrived later. During that gap, organizations needed to rely on exposure-reduction measures, including keeping management interfaces off the internet, as Palo Alto advised.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Apple Watch Series 12 GPS Smartwatch, 46mm
As an affiliate, we earn on qualifying purchases.
PHP Fixes and PAN-OS Release Dates
The PHP project released updated versions on October 21, addressing the two flaws Dream calls PHP2Shell. Palo Alto Networks published an advisory on the same date, but according to Dream, fixed builds for the affected PAN-OS 12.1 and 12.2 branches shipped between October 27 and 29. The firewall product uses its own bundled PHP version, so a PHP project release did not by itself patch affected PAN-OS devices.
Dream says its researchers traced the campaign from a wider pool of exposed devices: they identified about 19,000 PAN-OS firewalls with internet-facing management pages, obtained version information from about 5,000, then narrowed the selection to 240 targets based on country and software version. These figures describe Dream’s research and scanning; the report does not establish that all exposed devices were vulnerable or targeted.
Fragnesia had been disclosed in May with a public exploit, according to the source account. Dream says the attacker prepared an offensive-security platform called aiscan on October 8. The company published its investigation on October 26. CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog that day and set a three-day deadline for federal agencies, according to the source material.
““no direct evidence””
— Dream
AI’s Role and Intrusion Impact
The presence of Claude Code, DeepSeek and Kimi on attacker-controlled systems does not establish how they were used. Dream says it has no direct evidence that AI generated the exploit or attack scripts, and characterizes the operation as not appearing fully autonomous. The label “AI-assisted” should therefore be treated as an inference based on tools found, not a confirmed account of how the attack was conducted.
Several consequences remain unclear from the material provided. It does not specify whether the attacker successfully altered or accessed Active Directory, what information may have been taken, whether the 22 hidden web shells were removed, or whether all affected organizations were notified. The public account also does not provide a complete independent breakdown of Palo Alto Networks’ verification or the evidence behind each reported compromise.
Patch Affected PAN-OS Branches
Organizations using the affected PAN-OS branches should check Palo Alto Networks’ advisory and confirm that they have installed the fixed builds released between October 27 and 29, as applicable to their devices. The source material says the vendor advised keeping management pages off the internet while fixes were pending; restricting that access remains a direct way to reduce exposure.
Administrators should also review firewall and internal network logs for signs of unauthorized access, assess whether management credentials or directory systems may have been affected, and follow their incident-response procedures if they find evidence of compromise. CISA’s addition of the PHP2Shell CVEs to its exploited-vulnerability catalog sets a federal remediation deadline, while the extent of impact across the reported targets and any further findings from Dream, Palo Alto Networks or affected organizations remain to be clarified.
Key Questions
What happened in the PHP2Shell attack?
Dream says an attacker used PHP2Shell and the Linux kernel flaw Fragnesia to gain root access on 24 Palo Alto Networks firewalls, then reached an internal firewall management server at a U.S. government-affiliated organization.
Were the attacks confirmed by Palo Alto Networks?
Palo Alto Networks said its Unit 42 researchers independently verified the attacker’s tools and results. The detailed campaign timeline and reported impact are described in Dream’s investigation.
Did artificial intelligence create the exploit?
That has not been established. Dream found AI-related tools on the attacker’s servers but said it had no direct evidence they wrote the exploit or scripts.
What should organizations using PAN-OS do?
Check Palo Alto Networks’ advisory, install the applicable fixed PAN-OS builds, and keep management interfaces off the public internet. Organizations should also review for signs of unauthorized access and assess any possible impact to internal systems.
Source: ThorstenMeyerAI.com
