🔍 Read the full analysis: From Patch To Root: A Two-Day PHP2Shell Attack On 25 Palo Alto Servers on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Dream reported that an attacker exploited two PHP flaws and a known Linux kernel vulnerability to gain root access on 24 Palo Alto Networks firewalls, then compromised an internal firewall-management server at a U.S. government-affiliated organization. Palo Alto Networks says Unit 42 independently verified the tools and results; Dream found AI tools in the attacker’s environment but says it has no direct evidence they created the exploit.
An attacker gained root access to 24 Palo Alto Networks firewalls and compromised a 25th server inside a U.S. government-affiliated organization, according to Israeli security company Dream. The activity began on October 23, about two days after the PHP project released fixes for the two vulnerabilities known as PHP2Shell; Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results.
Dream’s account says the attacker targeted 240 firewalls in the United States, Japan, Taiwan and South Korea in an automated run on October 23. The attacker obtained root access on 24. On October 24, the attacker used two compromised firewalls belonging to a U.S. government-affiliated organization to reach its internal firewall-management server, bringing the reported total to 25 compromised servers. Dream says the attacker then targeted the organization’s Active Directory, which manages user identities and access. The source material does not establish what information, if any, was accessed or taken.
The reported intrusion chained the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with Fragnesia, a Linux kernel privilege-escalation flaw disclosed in May as CVE-2026-46300. Dream says the PHP flaws enabled command execution on the firewall, while Fragnesia allowed the attacker to raise privileges to root. Its account says the chain could be completed in under 15 minutes. That timing is Dream’s assessment, not a finding independently detailed in the supplied material.
Dream says 22 of the 24 rooted firewalls were left with a hidden web shell. The company also reported finding Claude Code installed on attacker infrastructure and DeepSeek and Kimi configured in an offensive-security platform called aiscan. But Dream said it had no direct evidence that AI tools wrote the exploit or scripts, and described the operation as not appearing fully autonomous. Palo Alto’s independent verification, as described in the source, concerns the attacker’s tools and results; it does not establish AI authorship.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
How Exposed Management Interfaces Enabled Access
The incident shows how quickly a known vulnerability can become an entry point when a device’s management interface is reachable from the internet and attackers can combine it with another weakness. Firewalls sit at network boundaries, but their administrative functions can provide a route deeper into an organization if compromised. In this case, Dream says the attacker moved from firewalls to an internal management server and then targeted Active Directory.
The account also highlights a patching gap: PHP had released fixes, but the affected PAN-OS branches did not yet have fixed builds when the reported attacks took place. Organizations cannot assume that updating an upstream component automatically updates a vendor’s product, especially when it includes its own copy of that software. Until vendor fixes are available, limiting administrative access to trusted networks can reduce exposure. The reported AI tooling may have helped the attacker work, but the evidence presented does not show that AI was necessary to carry out the intrusion.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From PHP Fixes to PAN-OS Updates
The PHP project released updated versions on October 21, 2026, and Palo Alto Networks published an advisory that day, according to the supplied account. The advisory listed fixed PAN-OS builds as forthcoming. Dream says the affected PAN-OS product used its own PHP copy, version 8.0.30, so the upstream PHP release did not itself patch the firewalls.
Dream’s timeline says its researchers identified about 19,000 PAN-OS firewalls with internet-facing management pages, obtained version information from about 5,000, then narrowed its target set to 240 based on country and software version. Those figures describe the company’s reported discovery and filtering process; they are not a count of devices ultimately confirmed vulnerable or compromised. The Fragnesia kernel flaw had been publicly disclosed and fixed in May, according to the source material, meaning it was already known before the October activity.
Dream published its findings on October 26 and updated them on October 29. The supplied account says the U.S. Cybersecurity and Infrastructure Security Agency added both PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26 and set a three-day deadline for federal agencies. Palo Alto’s fixed builds for the affected 12.1 and 12.2 branches shipped between October 27 and 29, according to the source.
““no direct evidence””
— Dream
Intrusion Scope and AI’s Role
The supplied reporting does not say whether the attacker successfully accessed, altered or exfiltrated data from the government-affiliated organization, or whether the Active Directory attack succeeded. It also does not identify the organization or provide a complete account of remediation, the duration of access, or whether other affected firewall owners were compromised.
AI involvement remains unresolved. Dream found AI-related tools and model configurations on attacker infrastructure, but said it had no direct evidence they generated the exploit or scripts. The reporting also does not specify how the tools were used. The scope of Palo Alto’s independent verification is described as covering the attacker’s tools and results, not every inference in Dream’s report.
Patch Builds and Federal Response
Organizations using affected PAN-OS branches should check Palo Alto Networks’ current security advisory and apply the fixed builds that match their software version. Until updates are installed, the reported exposure makes restricting management access to trusted networks a key defensive measure. Administrators should also review firewall and identity-system logs for signs of unauthorized access, following vendor and agency guidance.
Federal agencies were given a three-day deadline after CISA added the PHP2Shell flaws to its exploited-vulnerability catalog, according to the source. Further details may clarify whether the attacker accessed data, how the Active Directory targeting progressed, and how many exposed devices were affected beyond the 240 targets in Dream’s reported batch. Palo Alto’s advisory and subsequent updates remain the primary sources for product-specific fixes.
Key Questions
What happened in the PHP2Shell incident?
Dream reported that an attacker used two PHP vulnerabilities and a Linux kernel flaw to gain root access to 24 Palo Alto firewalls, then reached an internal management server at a U.S. government-affiliated organization.
Did the attacker compromise 25 firewalls?
No. Dream’s count is 25 servers: 24 Palo Alto firewalls and one internal firewall-management server. The source says the attacker then targeted Active Directory but does not confirm the outcome of that effort.
Did AI create the exploit?
That has not been established. Dream found AI tools and model configurations on attacker infrastructure, but said it had no direct evidence that AI wrote the exploit or scripts.
What should Palo Alto firewall administrators do?
Check Palo Alto Networks’ advisory and install the fixed PAN-OS build for the relevant branch. Restrict management interfaces to trusted networks and review logs for suspicious activity while following current vendor guidance.
Source: ThorstenMeyerAI.com
