🔍 Read the full analysis: PHP2Shell Attack Timeline: Patch To Root In Two Days on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Dream reported that an attacker used PHP2Shell and a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, then reached an internal server at a U.S. government-affiliated organization. The attack followed PHP fixes by about two days, but the report does not establish that AI tools wrote the exploit; Dream says it found no direct evidence of that.
Twenty-four Palo Alto Networks firewalls were compromised for root access in an automated attack on October 23, about two days after the PHP project released fixes for the flaws known as PHP2Shell, according to Israeli security company Dream. The next day, the attacker used compromised firewalls to reach a U.S. government-affiliated network and take over an internal server; Dream says the attacker then targeted Active Directory, which manages access to accounts and systems.
Dream’s report, published October 26 and updated October 29, says the attacker scanned exposed PAN-OS management pages, narrowed a larger pool of internet-facing devices to 240 targets, and attacked them in automated batches. Dream says 24 firewalls were rooted. The devices were located in the United States, Japan, Taiwan and South Korea. Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results.
The reported intrusion combined two vulnerabilities. PHP2Shell—CVE-2026-109618 and CVE-2026-109619—provided a way to execute code on the firewall’s management web server. Dream says that access initially ran with limited privileges. The attacker then used Fragnesia, CVE-2026-46300, a Linux kernel privilege-escalation flaw disclosed in May, to obtain root access. Dream says the complete chain, including installing a persistent back door, took less than 15 minutes.
Dream says 22 of the 24 firewalls were left with a hidden web shell. Two belonged to the government-affiliated organization. On October 24, the attacker used one compromised firewall to reach the organization’s internal firewall-management server, the 25th compromised server in Dream’s count. The report says activity against Active Directory followed. The supplied account does not specify whether the attacker obtained or removed data.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Pages Enabled Entry
The incident shows how a newly patched application flaw can remain exploitable on network appliances that use their own bundled software and have not yet received a vendor fix. According to Dream, the attacker could reach firewall management pages exposed to the internet, use PHP2Shell to gain an initial foothold, and pair it with an older kernel flaw to reach root-level control.
That matters beyond the firewalls themselves. The reported move from two compromised perimeter devices into an internal management server put a system used to manage other firewalls within reach. The attempted access to Active Directory could also have consequences for identity and access controls, although the available report does not establish what the attacker did there or whether accounts were compromised.
Dream found Claude Code installed on the attacker’s servers and found the models DeepSeek and Kimi configured in an offensive-security platform called aiscan. Those findings support the presence of AI tools in the environment, not proof that they created the exploit or ran the operation autonomously. The practical security issue identified in the report is more direct: exposed management interfaces, vulnerable software and an exploitable privilege-escalation path.
Popular right now
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Ninja DualZone Air Fryer 10 Qt Smart 6-in-1 Grey (DZ950)
As an affiliate, we earn on qualifying purchases.
From May Kernel Flaw to October Patches
Fragnesia was disclosed in May 2026, according to the timeline in Dream’s report, and had a public exploit. The attacker’s reported operation came months later, combining that kernel flaw with PHP vulnerabilities. This sequence matters because patching one layer does not necessarily remove risk when a separate, known weakness can be chained with it.
The PHP project released updated versions on October 21. Palo Alto Networks issued an advisory that day, but Dream says fixed builds for the affected PAN-OS 12.1 and 12.2 branches arrived between October 27 and 29. The firewall software included its own PHP copy, which meant that updating the standalone PHP project did not itself patch the affected appliance. Palo Alto’s advisory identified keeping management access off the public internet as a protective measure while fixes were pending.
Dream’s account says it found about 19,000 PAN-OS firewalls with internet-facing management pages before the attack, obtained version information from about 5,000, and reduced its candidate list to 240 based on country and software version. Those figures describe the stages in Dream’s reported targeting process; they are not a count of confirmed vulnerable or compromised systems worldwide.
““no direct evidence” that AI tools wrote the exploit or the scripts”
— Dream
AI Role and Intrusion Impact
The available reporting does not establish who operated the attack, whether AI tools contributed to exploit development, or how much human involvement the operation required. Dream’s discovery of Claude Code and configured DeepSeek and Kimi models is evidence that those tools were present, but the company says it has no direct evidence they wrote the exploit or scripts.
It is also unclear from the supplied account whether the attacker accessed, altered or exfiltrated data from the government-affiliated organization, or whether Active Directory accounts were successfully compromised. The report describes attacks on Active Directory but does not provide a confirmed outcome. The total number of exposed devices that were vulnerable, beyond the reported target pool and 24 successful firewall compromises, is also not established.
Patch Devices and Review Access
Organizations using affected PAN-OS branches should consult Palo Alto Networks’ current security advisory, apply the fixed builds that match their deployments, and restrict management interfaces from public internet access. Administrators should also check for the web shells and persistence indicators described by Dream and review firewall and identity-system logs for activity during and after October 23-24.
CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26 and gave federal agencies three days to act, according to the source account. Further reporting is needed to establish the scope of any government-network impact, the outcome of the Active Directory activity, and whether additional organizations were affected. Palo Alto Networks and security researchers may publish further technical indicators or findings as investigations continue.
Key Questions
What happened in the PHP2Shell attack?
Dream says an attacker combined PHP2Shell vulnerabilities with the Linux kernel flaw Fragnesia to obtain root access on 24 PAN-OS firewalls. The attacker then used compromised firewalls to reach an internal server at a U.S. government-affiliated organization.
Why did PHP fixes not immediately protect the firewalls?
The affected PAN-OS devices included their own copy of PHP. Dream says Palo Alto’s advisory was issued October 21, while fixed builds for the affected 12.1 and 12.2 branches arrived between October 27 and 29. The standalone PHP updates did not by themselves update that bundled software.
Did AI create or run the exploit?
That has not been established. Dream found Claude Code installed and DeepSeek and Kimi configured on the attacker’s servers, but said it had no direct evidence that AI tools wrote the exploit or scripts and that the attack did not appear fully autonomous.
How many systems were confirmed compromised?
Dream reports 24 firewalls with root access and one internal firewall-management server, for 25 servers in total. It says the devices were in the United States, Japan, Taiwan and South Korea.
What should organizations do now?
Organizations should install the applicable fixed PAN-OS versions, keep management pages inaccessible from the public internet, and review devices and logs for the indicators described by Dream. The report does not confirm the full impact on the government-affiliated organization, so affected operators should also investigate their internal systems and identity activity.
Source: ThorstenMeyerAI.com
