🔍 Read the full analysis: Tracing The PHP2Shell Chain From Patch To Root On Palo Alto Servers on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Dream reported that an attacker used PHP2Shell flaws and a previously disclosed Linux kernel vulnerability to gain root access on 24 Palo Alto Networks firewalls, then compromised an internal firewall-management server at a US government-affiliated organization. Palo Alto Networks says Unit 42 independently verified the attacker’s tools and results. Dream found AI tools on the attacker’s servers but says it has no direct evidence they wrote the exploit or scripts.
Attackers gained root access on 24 Palo Alto Networks firewalls by chaining two newly patched PHP flaws with a previously disclosed Linux kernel vulnerability, according to Israeli security company Dream. Dream said the October 23–24 operation also reached an internal firewall-management server at a US government-affiliated organization, making the incident a warning about exposed management interfaces and delayed patching.
Dream’s October 26 report, updated October 29, describes a targeted, automated campaign against PAN-OS firewalls. The attacker reportedly identified internet-accessible management pages, narrowed a pool of roughly 19,000 exposed devices to 240 potential targets, and attacked those targets in batches. Dream says 24 firewalls were compromised, with affected targets in the United States, Japan, Taiwan and South Korea. These figures and the campaign timeline come from Dream’s analysis; Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results.
The chain began with PHP2Shell, the name used for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Dream says they enabled command execution on the firewall’s management web server, initially under a low-privilege account. The attacker then used Fragnesia (CVE-2026-46300), a Linux kernel privilege-escalation flaw disclosed in May, to obtain root access. Dream says the attacker installed persistent back doors on 22 of the compromised firewalls.
Two affected firewalls belonged to the government-affiliated organization, Dream reported. The attacker used one as a route to an internal server managing the organization’s firewalls, bringing the reported total to 25 compromised servers. Dream says the attacker then targeted the organization’s Active Directory, which controls identity and access across a network. The supplied account does not establish the full extent of any resulting access or data theft.
The timing left a short window between the PHP project’s fixes and available PAN-OS fixes. PHP released patched versions on October 21, the same day Palo Alto Networks published an advisory describing its own remediation as forthcoming. According to the source account, fixed builds for the affected 12.1 and 12.2 branches shipped between October 27 and 29. Before those builds were available, Palo Alto’s stated protective measure was to keep the management interface off the public internet.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Pages Became Entry Points
The reported intrusion shows how a vulnerability rated for initial code execution can become a full system compromise when it is paired with a separate privilege-escalation flaw. In Dream’s account, PHP2Shell provided a foothold, while the Linux kernel bug elevated access to root, the system’s highest privilege. This chain matters to organizations running affected firewalls because the device’s management plane can provide a route into internal network systems.
The report also highlights the operational gap between an advisory and a deployable fix. Palo Alto Networks had issued an advisory on October 21, but, according to the source material, fixed builds for the relevant branches followed days later. During that interval, keeping management pages inaccessible from the internet was the stated mitigation. The case does not show that every exposed device was vulnerable or compromised, but it illustrates the risk of leaving administrative services publicly reachable while remediation is pending.
Dream’s findings about AI tools have drawn attention, but they do not establish that artificial intelligence created or ran the attack. The confirmed security concerns in the account are the vulnerability chain, exposed interfaces and persistence mechanisms. The role of the installed tools remains an inference, not a demonstrated cause.
Popular right now
TCL T7 Series 85-Inch 4K 144Hz QLED Smart Google TV
De'Longhi 15-Bar Pump Espresso Machine with Milk Frother & Temperature Control
Samsung 85-Inch QN70H Neo QLED 4K Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
Two Fixes, One Exploit Window
The PHP project released fixes for the two PHP2Shell vulnerabilities on October 21, 2026. Palo Alto Networks issued an advisory that day, while fixes for the affected PAN-OS branches were still forthcoming. Dream says the attacks began on October 23, about two days after the PHP fixes were released and before the firewall builds it identifies as fixed became available.
The chain also relied on Fragnesia, a Linux kernel flaw made public in May 2026 with a public exploit, according to Dream’s timeline and the source material. This means the reported operation did not depend solely on the newly disclosed PHP flaws: it combined them with an older vulnerability. Dream says it found the attacker’s AI platform, aiscan, configured with DeepSeek and Kimi on October 8, and found Claude Code installed on the attacker’s servers. Those discoveries indicate access to AI tools, but do not show how they were used.
On October 26, the US Cybersecurity and Infrastructure Security Agency added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog and set a three-day deadline for federal agencies, according to the source material. That government response followed Dream’s publication and underscores the urgency for agencies covered by the directive.
““no direct evidence” that AI tools wrote the exploit or the scripts”
— Dream
AI Use and Network Impact Remain Unclear
Dream says it found Claude Code, DeepSeek and Kimi among tools or configurations on the attacker’s servers. It has not provided direct evidence, in the supplied account, that those systems generated the exploit, wrote the scripts or made operational decisions. The label “AI-assisted” should therefore be treated as a description of the environment or a hypothesis about the workflow, not as a confirmed explanation of how the attack was built.
The full impact on the government-affiliated organization is also not established in the source material. Dream reported that the attacker targeted Active Directory, but did not specify whether credentials were taken, how many accounts or systems were affected, or whether sensitive information was accessed or removed. The report also does not identify the organization or provide enough information to independently assess every affected target.
The account gives counts of exposed devices and successful compromises, but these are Dream’s observations from its scanning and investigation, not a complete census of all vulnerable PAN-OS deployments. It remains unclear how many devices were subsequently patched, whether other attackers used the same chain, and whether all reported persistence was removed.
Patch Deployment and Incident Review
Organizations using affected PAN-OS branches should check Palo Alto Networks’ advisory and apply the fixed builds applicable to their software version. Where a fix is not yet installed, the source account identifies removing public access to the management interface as the interim protection. Security teams should also review firewall and network logs for unusual management access, persistence, outbound tunnels and activity involving Active Directory.
Federal agencies were given three days after CISA’s October 26 catalog action to address the listed PHP2Shell vulnerabilities, according to the source material. The source does not specify the status of compliance or any later CISA action. Further reporting from Dream, Palo Alto Networks or the affected organization may clarify the scale of the internal compromise, the extent of remediation and whether investigators can establish a direct role for AI tools.
Key Questions
What does PHP2Shell refer to in this report?
PHP2Shell is the name used for two PHP flaws, CVE-2026-109618 and CVE-2026-109619. Dream says they enabled command execution on the management web server of targeted PAN-OS firewalls.
How did the attacker get root access?
According to Dream, the attacker paired PHP2Shell with Fragnesia (CVE-2026-46300), a Linux kernel privilege-escalation flaw disclosed in May. The first step provided a low-privilege foothold; the kernel flaw was then used to reach root access.
Were 25 firewalls compromised?
No. Dream reported 24 compromised firewalls and one additional internal firewall-management server, for 25 servers in total. It said two of the firewalls belonged to a US government-affiliated organization.
Did AI create the exploit?
That has not been established. Dream found AI tools on the attacker’s servers but said it had no direct evidence that they wrote the exploit or scripts, and that the operation did not appear fully autonomous.
What should operators do?
Operators should consult Palo Alto Networks’ advisory, install the fixed build for their PAN-OS branch, and restrict management access from the public internet. They should also investigate for signs of unauthorized access and persistence.
Source: ThorstenMeyerAI.com
