🔍 Read the full analysis: A Timeline Of The PHP2Shell Chain That Compromised 25 Palo Alto Servers on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Dream reported that an attacker used PHP2Shell flaws and a previously disclosed Linux kernel bug to gain root access on 24 Palo Alto Networks firewalls, then reached an internal management server at a U.S. government-affiliated organization. Palo Alto Networks says Unit 42 independently verified the attacker’s tools and results. Dream found AI tools in the attacker’s environment but said it has no direct evidence they created the exploit or scripts.
Dream, an Israeli AI security company, says an attacker compromised 25 servers after chaining two PHP flaws known as PHP2Shell with a previously disclosed Linux kernel vulnerability. The targets included 24 Palo Alto Networks firewalls and an internal firewall-management server at a U.S. government-affiliated organization; Palo Alto says its Unit 42 researchers independently verified the attacker’s tools and results.
Dream’s timeline says the attacker ran an automated operation against 240 selected firewalls on the evening of October 23, gaining root access on 24. The targets were in the United States, Japan, Taiwan and South Korea. Dream says 22 rooted firewalls were left with a hidden web shell, while two belonged to the government-affiliated organization later breached internally.
According to Dream, the attacker first used PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 to run code on the firewall management web server. A separate Linux kernel flaw, Fragnesia (CVE-2026-46300), then enabled escalation to root. Dream says the full chain, including installation of a persistent back door, took under 15 minutes. That duration and the attack sequence are reported by Dream, rather than independently established here.
On October 24, the attacker used one compromised firewall as a route to a second firewall belonging to the same organization. Dream says the attacker then reached the organization’s internal firewall-management server at 11:35 UTC and targeted Active Directory, which governs access to accounts and systems. The source account does not specify what data, if any, was accessed or changed in Active Directory.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
The Patch Gap Exposed Management Interfaces
The incident highlights the risk of exposing firewall management pages directly to the internet. These interfaces control network rules and device settings; access to them can give an intruder a route beyond the perimeter device and into systems managed from inside the network.
Timing also mattered. PHP released fixes on October 21, but Dream says PAN-OS builds fixing the issue for the affected 12.1 and 12.2 branches did not ship until October 27–29. Palo Alto’s October 21 advisory described fixed builds as forthcoming. During that interval, Palo Alto advised restricting management access rather than relying on a patch that was not yet available for those branches.
The reported move from firewalls to an internal management server shows why perimeter devices are high-value targets: one compromised system can provide access to other network controls. Dream’s account says the attacker also went after Active Directory, but it does not establish the extent or outcome of that activity.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Kernel Disclosure to Firewall Fixes
Dream places the earlier vulnerability in May 2026, when Fragnesia was disclosed with a public exploit and a kernel fix. The attacker’s preparation reportedly included setting up an offensive-security platform called aiscan on October 8, with the models DeepSeek and Kimi configured.
On October 21, PHP released updated versions of its supported branches, and Palo Alto Networks issued an advisory about the PHP flaws in PAN-OS. Dream says about 19,000 firewalls with internet-facing management pages were identified through FOFA, a search engine for internet-connected devices. A custom scanner reportedly obtained version information from about 5,000; filtering by country and software version reduced the attacker’s target list to 240.
Dream says the first government-affiliated firewall was compromised at 18:14 UTC on October 23 and crashed shortly afterward, possibly because of the volume of attack traffic. CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26 and set a three-day deadline for federal agencies. Palo Alto’s fixed builds for the affected branches followed between October 27 and 29, according to the source material.
““no direct evidence””
— Dream
AI Use and Intrusion Impact Remain Unclear
AI’s role has not been established. Dream found Claude Code installed on the attacker’s servers and DeepSeek and Kimi configured in aiscan. The company said it has no direct evidence that these tools wrote the exploit or scripts, and its findings do not show that the attack was fully autonomous. Their presence indicates access to AI tools, not proof of how they were used.
The available account also leaves open what the attacker did after reaching Active Directory, whether credentials or data were taken, and whether the organization contained all access. Dream reports 25 compromised servers, but the supplied material does not identify the affected organizations by name or describe their recovery status. Palo Alto’s independent verification is reported, but details of its methods and findings are not provided.
Patch, Restrict Access, Check for Persistence
Organizations using affected PAN-OS versions should apply the relevant fixed builds and restrict management interfaces to trusted networks or approved access paths. Those steps are especially time-sensitive for devices that were reachable from the public internet during the period between Palo Alto’s advisory and the release of fixes.
Security teams should also review affected firewall activity for signs of unauthorized access and persistence, and investigate connected management systems and identity infrastructure. CISA’s October 26 catalog action set a three-day deadline for federal agencies, while the source account does not provide a later compliance update. Further details about the government-affiliated organization’s response, the scope of any Active Directory impact and the attacker’s use of AI remain outstanding.
Key Questions
What were the PHP2Shell flaws used in the attack?
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two PHP flaws that Dream says were used to run code on the PAN-OS management web server. The attacker then chained them with the Fragnesia Linux kernel flaw to gain root access.
How many systems were compromised?
Dream reports 25 servers in total: 24 Palo Alto firewalls and one internal firewall-management server at a U.S. government-affiliated organization. Palo Alto Networks says Unit 42 independently verified the attacker’s tools and results.
Did AI create the exploit?
That has not been confirmed. Dream found AI tools and model configurations in the attacker’s environment but said it had no direct evidence that AI wrote the exploit or scripts. It also said the activity did not appear fully autonomous.
Why did the patch timing matter?
PHP released fixes and Palo Alto issued an advisory on October 21, but the affected PAN-OS branches received fixed builds between October 27 and 29, according to Dream. In the meantime, Palo Alto’s advisory pointed to restricting access to management interfaces.
What is still unknown about the government-affiliated network?
The reported account says the attacker reached the internal management server and targeted Active Directory, but it does not explain what data or accounts were affected, how much access the attacker retained, or the organization’s recovery status.
Source: ThorstenMeyerAI.com
