🔍 Read the full analysis: How A PHP2Shell Chain Moved From Patch To Root In Two Days on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream reported that an attacker exploited two PHP flaws and a previously disclosed Linux kernel vulnerability to gain root access on 24 Palo Alto Networks firewalls. The chain was used to reach a 25th server inside a US government-affiliated network. Dream found AI tools on the attacker’s systems but said it has no direct evidence they wrote the exploits.
Attackers gained root access on 24 Palo Alto Networks firewalls about two days after PHP released fixes for two critical flaws dubbed PHP2Shell, then used a compromised firewall to reach an internal server at a US government-affiliated organization, according to security firm Dream. Dream published its account on October 26 and updated it October 29; Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results.
Dream says the attacker combined PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 with Fragnesia, a Linux kernel privilege-escalation flaw disclosed in May and tracked as CVE-2026-46300. The PHP flaws allowed code execution on the firewalls’ management web server; Fragnesia was then used to elevate access to root, the system’s administrator account. Dream says the chain could be completed in under 15 minutes.
The attack ran on October 23 against 240 selected firewalls, after scanning and filtering a larger pool of internet-exposed devices, Dream reported. It says 24 were rooted, with targets in the United States, Japan, Taiwan and South Korea. On October 24, the attacker used two firewalls associated with the government-affiliated organization to reach its internal firewall-management server, the 25th compromised server, and then targeted Active Directory, which manages user identities and access.
Dream said 22 of the 24 firewalls were left with hidden web shells. The report describes a sequence of automated attacks, persistence measures and movement into the organization’s network. Palo Alto’s advisory appeared on October 21, the same day PHP published updates to supported PHP branches. Dream says fixed PAN-OS builds for the affected 12.1 and 12.2 branches were released between October 27 and 29; until then, the vendor advised limiting access to management interfaces.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Interfaces Enabled Entry
The reported incident shows how internet-accessible administrative interfaces can turn newly disclosed software flaws into a direct route to control of network equipment. A firewall is meant to enforce an organization’s security rules; control of its management functions can give an intruder a foothold for persistence and access to systems behind it.
The reported move into a government-affiliated network raises the stakes beyond the compromised devices. Dream says the attacker reached the server used to manage the organization’s firewalls and then targeted Active Directory. The available account does not say what data, if any, was taken, or whether the attacker gained control of directory accounts. Still, the sequence underscores why management pages should not be exposed to the public internet and why patching must include vendor-specific operating-system builds, not only upstream software.
Dream also found Claude Code installed and DeepSeek and Kimi configured in an offensive-security platform called aiscan. That makes AI assistance a point of interest, but not a confirmed explanation for the attack’s speed or success. The vulnerabilities, exposed interfaces and access-control conditions are the concrete issues described in the report.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Two Vulnerabilities, One Escalation Chain
PHP2Shell refers here to two vulnerabilities in PHP. Dream says PAN-OS included its own copy of PHP, version 8.0.30, so fixing PHP upstream did not itself update the software embedded in the firewalls. PHP released updates on October 21; Palo Alto also issued an advisory that day, but the fixed PAN-OS versions for the affected branches followed between October 27 and 29, according to Dream.
The second part of the chain, Fragnesia, was a Linux kernel privilege-escalation flaw disclosed in May, with a public exploit and a kernel fix, according to the source account. In Dream’s description, PHP2Shell first provided limited command execution under the web server’s low-privilege account. Fragnesia then enabled escalation. The incident therefore involved both a newly patched application component and an older kernel issue—not a single vulnerability that independently provided full control.
Dream says the attacker first identified about 19,000 PAN-OS devices with management interfaces exposed to the internet, then obtained version responses from roughly 5,000 and narrowed the list to 240 based on location and software version. Those figures describe the report’s scanning and selection process, not a count of confirmed vulnerable devices worldwide.
“The company said it had “no direct evidence” that AI tools wrote the exploit or scripts.”
— Dream
AI Use and Network Impact Remain Unclear
Dream found Claude Code installed and DeepSeek and Kimi configured within aiscan on the attacker’s servers. But it said it had no direct evidence that those tools created the exploit or attack scripts. Their presence does not establish how much, if any, AI contributed, and the report does not describe the operation as fully autonomous.
The source account does not specify whether the Active Directory attack succeeded, whether information was accessed or removed, or whether the attacker used the hidden web shells for further activity. It also does not identify the affected organization by name. The reported count of 24 rooted firewalls reflects Dream’s findings; the full number of affected devices and any additional victims are not established in the supplied material.
Patch Rollout and Incident Review
Organizations running affected PAN-OS branches should consult Palo Alto Networks’ current security guidance, install the applicable fixed build and restrict management access to trusted networks. Dream’s account says management pages should not be exposed directly to the internet, particularly while a vendor fix is pending. Operators should also check for unauthorized persistence and review firewall and identity-system logs as part of incident response.
Further clarity depends on updates from the vendor, Dream and the affected organization. Readers should look for confirmation of the Active Directory impact, the extent of any data access, and whether additional systems were compromised. Claims about AI’s role should remain qualified unless investigators provide evidence linking the discovered tools to the exploit or scripts.
Key Questions
What happened in the PHP2Shell incident?
Dream says an attacker chained two PHP vulnerabilities with a Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, then used compromised equipment to reach an internal server at a US government-affiliated organization.
Did PHP’s October 21 fixes protect PAN-OS firewalls immediately?
Not by themselves, according to Dream. PAN-OS included its own PHP build, and fixed PAN-OS versions for the affected 12.1 and 12.2 branches reportedly arrived between October 27 and 29. The vendor had issued an advisory on October 21.
Did AI write the attack?
That has not been established. Dream found AI tools and models on the attacker’s servers but said it had no direct evidence they wrote the exploit or scripts.
How many systems were reportedly compromised?
Dream reported root access on 24 firewalls and access to one internal firewall-management server, for 25 servers in total. It did not establish the full number of affected systems or the extent of any data access.
Source: ThorstenMeyerAI.com
