🔍 Read the full analysis: The Patch-to-Root Journey Of A PHP2Shell Chain In Two Days on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream says an attacker used PHP2Shell with a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, then reached a 25th server inside a U.S. government-affiliated network. Palo Alto Networks’ Unit 42 independently verified the attacker’s tools and results, according to Dream. AI tools were found on the attacker’s systems, but Dream says it has no direct evidence they created the exploit or scripts.
An attacker gained root access on 24 Palo Alto Networks firewalls and used one organization’s compromised devices to reach an internal server, according to an investigation by Israeli security company Dream. The attacks began on October 23, two days after PHP released fixes for flaws dubbed PHP2Shell; Dream says the attacker combined those flaws with a previously disclosed Linux kernel bug.
Dream’s account, published October 26 and updated October 29, says the attacker selected 240 firewalls after scanning exposed management interfaces and checking device versions. An automated attack run between 18:14 and 21:55 UTC on October 23 compromised 24 devices. The reported targets were in the United States, Japan, Taiwan and South Korea. Palo Alto Networks’ Unit 42 researchers independently verified the attacker’s tools and results, Dream said.
The chain combined PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 with Fragnesia, a Linux kernel privilege-escalation flaw tracked as CVE-2026-46300 and publicly disclosed in May. Dream says PHP2Shell enabled command execution as a low-privilege account on the firewall, while Fragnesia enabled the attacker to elevate access to root. The company reported that the sequence could be completed in under 15 minutes; that timing is Dream’s estimate.
Dream says 22 compromised firewalls were left with hidden web shells. At a U.S. government-affiliated organization, the attacker compromised two firewalls on October 23 and 24, established a tunnel and used it to reach an internal firewall-management server at 11:35 UTC on October 24. That made 25 servers in total: 24 firewalls and one internal server. Dream also reported attempts against the organization’s Active Directory, which controls access to accounts and systems.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Interfaces Enabled Access
The report highlights how a recently patched software flaw can still pose a threat when affected systems are exposed and fixes for the relevant product are not yet available. Dream says the attack began within days of the PHP releases, but the firewalls used PAN-OS’s bundled PHP version, rather than a separately updated PHP installation. Palo Alto Networks published an advisory on October 21; according to the source account, fixed builds for the affected 12.1 and 12.2 branches arrived between October 27 and 29.
For operators, the reported path from a firewall’s management interface to an organization’s internal network shows why management access should be restricted and why patch timelines need to include vendor-specific products. The incident also underlines that a firewall is itself a computer with software and administrative interfaces: compromising the device can create a route inward. Dream’s reporting describes an attempted move from firewall access to Active Directory, though the extent of any access to directory data or accounts is not established in the supplied material.
The case is also being discussed as an AI-assisted attack, but the available evidence does not establish that AI generated the exploit. Dream found AI-related tools and configurations on the attacker’s infrastructure. It said it had no direct evidence that those tools wrote the exploit or scripts. That distinction matters: the confirmed reporting concerns the observed intrusion and tools found, while AI’s role remains an inference.
Products Worth Considering
FLEXISPOT Standing Desk with Monitor Riser & Cable Management
Samsung Essential S3 27-Inch Curved FHD Monitor
Samsung 34-Inch ViewFinity S50GC Ultra-WQHD Monitor
As an affiliate, we earn on qualifying purchases.
Patch Dates and the Attack Window
PHP published updates on October 21, including releases for versions 8.5, 8.4, 8.3 and 8.2, and urged users to update. Palo Alto Networks issued an advisory that day, while fixed PAN-OS builds were still forthcoming. Dream says the targeted firewalls ran a vendor-supplied PHP 8.0.30, so installing a standard PHP update would not by itself update that embedded component.
Dream’s timeline says the attacker first identified roughly 19,000 firewalls with internet-facing management pages using FOFA, an internet-connected device search engine. A custom scanner obtained version information from about 5,000; filtering by country and software version reduced the list to 240 targets. These figures describe successive stages of Dream’s reported reconnaissance, not a confirmed count of all vulnerable or compromised devices worldwide.
The other flaw in the chain, Fragnesia (CVE-2026-46300), had been disclosed publicly in May with an exploit and a kernel fix, according to the source material. The sequence therefore brought together a newly patched PHP issue and a months-old privilege-escalation vulnerability. On October 26, the U.S. Cybersecurity and Infrastructure Security Agency added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog and set a three-day deadline for federal agencies, according to the supplied account.
““no direct evidence””
— Dream
AI’s Role and Intrusion Scope
The evidence described by Dream does not establish whether AI generated any part of the exploit or attack scripts. The company found Claude Code installed and DeepSeek and Kimi configured in an offensive-security platform called aiscan, but said it had no direct evidence connecting those tools to the exploit’s creation. It also said the operation did not appear fully autonomous.
The supplied account does not establish whether the attacker obtained Active Directory credentials or data, how many accounts or systems may have been affected, or whether the 22 web shells remained active after discovery. It also does not provide a final count of systems remediated across all affected organizations. The reported 240 targets were selected for an attack run; Dream says 24 were rooted, but the figures should not be read as a census of every vulnerable firewall.
The source material attributes independent verification of the attacker’s tools and results to Palo Alto Networks’ Unit 42. It does not include a direct public statement from the government-affiliated organization about the intrusion, or a full incident-response account detailing containment and recovery.
Vendor Fixes and Network Checks
According to the supplied timeline, Palo Alto Networks released fixed builds for the affected PAN-OS 12.1 and 12.2 branches between October 27 and 29. Administrators should consult the vendor’s advisory for the affected versions and update guidance, while checking whether management interfaces were reachable from the public internet during the exposure window. Until a device is patched, the source account identifies restricting management access from the internet as a protective measure.
Organizations that operated exposed or affected firewalls will need to check for signs of compromise, including unauthorized web shells, unexpected accounts or configuration changes, and tunnels or connections to unfamiliar systems. Because Dream reported access to an internal firewall-management server and attempts against Active Directory, incident reviews should also cover connected management systems and identity infrastructure, not only the perimeter devices.
The next public developments to watch are any further vendor or government advisories, details from affected organizations, and updated findings from Dream or Unit 42. The supplied material does not state whether the investigation has identified the attacker or confirmed the full extent of activity after the reported October 24 access.
Key Questions
What were the PHP2Shell vulnerabilities used in this incident?
They are CVE-2026-109618 and CVE-2026-109619, two flaws for which PHP released fixes on October 21, 2026. Dream says the attacker used them to run commands on affected firewalls, then chained them with a Linux kernel vulnerability to gain root access.
How many systems did Dream say were compromised?
Dream reported root access on 24 PAN-OS firewalls and access to one internal firewall-management server at a U.S. government-affiliated organization: 25 servers in total. It also reported 240 firewalls in the automated attack batch, not 240 confirmed compromises.
Did AI create the exploit?
That is not established by the available evidence. Dream found Claude Code and configurations for DeepSeek and Kimi on the attacker’s systems, but said it had no direct evidence that AI tools wrote the exploit or scripts.
What should PAN-OS administrators do?
Administrators should review Palo Alto Networks’ advisory, install the applicable fixed PAN-OS build, and restrict management interfaces from public internet access. Organizations should also investigate affected firewalls and connected management and identity systems for signs of unauthorized access.
Source: ThorstenMeyerAI.com
