🔍 Read the full analysis: The Anatomy Of A PHP2Shell Chain That Took Over 25 Palo Alto Servers on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream reported that an attacker compromised 24 Palo Alto Networks firewalls and then reached an internal firewall-management server, for 25 servers in total. Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results. AI tools were found on the attacker’s infrastructure, but Dream says it has no direct evidence they wrote the exploit or scripts.
Attackers used recently disclosed PHP2Shell vulnerabilities alongside a previously known Linux kernel flaw to gain root access to 24 Palo Alto Networks firewalls and reach a 25th server inside a U.S. government-affiliated organization, according to security company Dream. Palo Alto Networks says its Unit 42 researchers independently verified the attackers’ tools and results; Dream’s findings also point to the risks of internet-accessible management pages before vendor fixes were available.
Dream said the attacker began an automated operation on the evening of October 23, targeting 240 firewalls after narrowing a larger set of internet-exposed devices by location and software version. The company reported that 24 firewalls were compromised across the United States, Japan, Taiwan and South Korea. It said 22 were left with a hidden web shell, a method for maintaining remote access.
Dream’s account says the attacker first exploited two PHP flaws, identified as CVE-2026-109618 and CVE-2026-109619, to run code on the firewall’s management web server. The attacker then combined that access with Fragnesia, CVE-2026-46300, a Linux kernel privilege-escalation flaw made public in May, to obtain root access. Dream said the full chain to a persistent back door took less than 15 minutes. These technical details are the security company’s findings; Palo Alto Networks has separately said Unit 42 verified the tools and results.
In a second stage on October 24, Dream says the attacker used two compromised firewalls belonging to the same government-affiliated organization to reach its internal firewall-management server. That brought the reported total to 25 compromised servers. Dream said the attacker then targeted the organization’s Active Directory, which manages user identities and access. The source account does not establish the extent of any resulting access to accounts or data.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Pages Expanded the Breach
The incident shows how an internet-facing administration interface can turn a software flaw into a route through an organization’s network. The initial PHP vulnerabilities provided code execution with limited privileges, but the separate kernel flaw allowed the attacker to escalate access. In the government-affiliated network, compromised firewalls then provided a path to a server used to manage other firewalls.
Timing matters: PHP fixes were released on October 21, and Palo Alto Networks issued an advisory that day, but according to the source account, fixed PAN-OS builds for the affected 12.1 and 12.2 branches arrived between October 27 and 29. That left a period when administrators needed to reduce exposure through configuration and network controls rather than rely on an available firewall software fix. The report does not establish that every exposed firewall was vulnerable or compromised.
Dream also found AI-related software on infrastructure it attributed to the attacker. That is relevant to how the operation may have been prepared, but it does not prove that AI generated the exploit or operated the attack. The more directly supported security lesson is that exposed management services and known vulnerabilities can be combined quickly when targets have not been patched or adequately isolated.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Patch Dates and the Exploit Chain
The chain combined newly fixed PHP flaws with an older kernel vulnerability. Dream says Fragnesia was disclosed and fixed in May 2026 and had a public exploit. The PHP project released updates on October 21, including fixes for the flaws later called PHP2Shell. Palo Alto Networks also published an advisory that day, with fixed PAN-OS versions still forthcoming, according to the supplied account.
Dream reported that its investigation found about 19,000 PAN-OS firewalls with internet-facing management pages. A custom scanner obtained version information from about 5,000, after which the attacker filtered targets by country and version to produce a list of 240. These figures describe the stages Dream reported, not a count of confirmed vulnerable or compromised devices.
Dream’s timeline says the attacker set up the platform aiscan on October 8, with DeepSeek and Kimi configured, and later had Claude Code installed on its servers. The attack was reported to CISA on October 26, when the agency added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog and set a three-day deadline for federal agencies, according to the source material.
““no direct evidence” that AI tools wrote the exploit or scripts”
— Dream
AI Role and Network Impact Remain Unclear
Dream found Claude Code installed and DeepSeek and Kimi configured in aiscan on infrastructure it associated with the attacker. It explicitly said it had no direct evidence that these tools created the exploit or scripts, and its assessment was that the operation did not appear fully autonomous. The precise role, if any, of AI assistance remains unconfirmed.
The full consequences of the compromise are also not clear from the available account. Dream reported attacks on Active Directory but did not specify whether credentials were stolen, accounts were accessed, data was taken, or the organization’s operations were disrupted. The supplied material does not name the government-affiliated organization or provide a complete breakdown of affected customers. It also does not say whether every reported web shell or back door has been removed.
Patch, Isolate, and Verify Access
Organizations using affected PAN-OS branches should consult Palo Alto Networks’ advisory and apply the fixed release that matches their deployment. The timeline in the source material says fixes for the affected 12.1 and 12.2 branches shipped from October 27 to 29. Administrators should also restrict firewall management interfaces to trusted networks, review access and system logs for suspicious activity, and investigate for persistence rather than assuming that installing a patch alone removes an existing compromise.
Federal agencies were given a three-day deadline after CISA added the PHP2Shell flaws to its exploited-vulnerabilities catalog, according to the supplied account. Further public reporting from Dream, Palo Alto Networks or affected organizations may clarify the attacker’s reach, the state of remediation and whether the Active Directory targeting led to unauthorized access. Those outcomes are not established in the information currently available.
Key Questions
What does PHP2Shell refer to in this report?
PHP2Shell is the name used for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Dream says they allowed the attacker to run code on the affected firewall management web server, initially with limited privileges.
How many servers did Dream say were compromised?
Dream reported 24 compromised firewalls and a 25th server inside a U.S. government-affiliated organization. The internal server managed the organization’s firewalls.
Did AI create or run the attack?
That has not been established. Dream found AI-related tools on infrastructure it attributed to the attacker, but said it had no direct evidence that they wrote the exploit or scripts and that the operation did not appear fully autonomous.
What should PAN-OS administrators do?
Apply the fixed PAN-OS release specified in Palo Alto Networks’ advisory, restrict management interfaces to trusted networks, and check for signs of prior compromise. Dream’s report says hidden web shells were left on 22 of the 24 rooted firewalls, so patching should not replace a review for persistence.
Source: ThorstenMeyerAI.com
