🔍 Read the full analysis: How PHP2Shell Went From Patch To Root On Palo Alto Servers on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream reported that an attacker used PHP2Shell flaws and a previously disclosed Linux kernel vulnerability to gain root access on 24 Palo Alto Networks firewalls. The company says the attacker then reached a firewall-management server at a U.S. government-affiliated organization; Palo Alto Networks’ Unit 42 independently verified the attacker’s tools and results. Dream found AI tools in the attacker’s environment but said it has no direct evidence they created the exploit.
Attackers used two newly patched PHP2Shell vulnerabilities together with a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, according to Israeli security company Dream. Dream said the attackers then used compromised equipment to reach an internal firewall-management server at a U.S. government-affiliated organization; Palo Alto Networks’ Unit 42 said it independently verified the attackers’ tools and results.
Dream’s account, published October 26 and updated October 29, describes an automated attack on October 23 against 240 selected firewalls. The targets were in the United States, Japan, Taiwan and South Korea. Dream said 24 firewalls were rooted, while 22 were left with a hidden web shell. The report says the attacker had first identified roughly 19,000 PAN-OS firewalls with management pages exposed to the internet, then narrowed the list using a scanner and additional filters. These figures and the account of the operation come from Dream.
The attacker chained CVE-2026-109618 and CVE-2026-109619, the PHP2Shell flaws, with Fragnesia (CVE-2026-46300), a Linux kernel privilege-escalation vulnerability disclosed in May. Dream says PHP2Shell provided command execution on the firewall as a restricted user, while Fragnesia enabled the move to root. The report says the sequence, including installation of a persistent back door, took less than 15 minutes. This describes Dream’s findings; it is not a general measure of how quickly every vulnerable firewall could be compromised.
Dream reported a further intrusion on October 24. After compromising a second firewall belonging to the government-affiliated organization, the attacker established a tunnel and used it to reach the organization’s internal firewall-management server. Dream identified that machine as the 25th compromised server and said attacks on the organization’s Active Directory followed. The source does not provide a confirmed account of what data, if any, was accessed or changed.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Interfaces Enabled Access
The incident shows how an internet-accessible firewall management interface can expose more than the device itself. In Dream’s account, control of two perimeter firewalls provided a route to an internal system used to manage the organization’s other firewalls, followed by activity directed at Active Directory, which governs identity and access across many networks.
The timing also matters. PHP released fixes for the PHP2Shell flaws on October 21, and Palo Alto Networks published an advisory that day, but Dream said fixed builds for the affected PAN-OS 12.1 and 12.2 branches arrived between October 27 and 29. That left a period when administrators needed to rely on mitigations, including keeping management interfaces off the public internet, while waiting for applicable updates. The reported chain also used Fragnesia, a kernel flaw already public for months, underscoring that known vulnerabilities can remain useful to attackers when systems are exposed or unpatched.
Dream’s report points to AI tools found on the attacker’s systems, but that detail does not establish that AI produced the exploit or carried out the intrusion autonomously. The confirmed operational concern is the combination of vulnerable software, reachable management services and a path from perimeter equipment into internal administration systems.
Products Worth Considering
Samsung 85-Inch QN70H Neo QLED 4K Smart TV (2026)
Philips Hue Festavia Globe Outdoor String Lights, 32 Bulbs, 91 ft
Sony BRAVIA 5 85-Inch Mini LED 4K HDR Smart TV (K-85XR50)
As an affiliate, we earn on qualifying purchases.
Patches Followed the October 21 Advisory
PHP published security updates on October 21 for the versions containing PHP2Shell. Palo Alto Networks issued an advisory on the same date, describing fixes for PAN-OS as upcoming. Dream says the firewalls it examined included Palo Alto’s own bundled PHP version, 8.0.30. According to the report, updated PAN-OS builds for the attacked 12.1 and 12.2 branches were released from October 27 through October 29.
Fragnesia, the kernel vulnerability used to raise privileges, had been disclosed in May 2026 with a public exploit and a kernel fix, according to Dream’s cited timeline. The attacker’s reported preparation included setting up an offensive-security platform called aiscan on October 8. Dream said its researchers found Claude Code installed and DeepSeek and Kimi configured in aiscan. Those observations establish that the tools were present in the environment Dream examined, not that they were used to write or execute the attack.
On October 26, the U.S. Cybersecurity and Infrastructure Security Agency added both PHP2Shell CVEs to its catalog of known exploited vulnerabilities and set a three-day remediation deadline for federal agencies, according to the source material. That action followed Dream’s publication and came before Palo Alto’s reported release of fixes across the affected branches was complete.
““No direct evidence” shows that AI tools wrote the exploit or scripts.”
— Dream
AI Use and Intrusion Impact Remain Unverified
The role of AI in the operation remains unproven. Dream found Claude Code and configured DeepSeek and Kimi models in the attacker’s environment, but explicitly said it had no direct evidence that the tools generated the exploit or scripts. The available account also does not establish whether AI helped with target selection, attack automation or analysis.
Dream reported attacks on Active Directory but the supplied material does not say whether the attacker successfully changed accounts, obtained credentials, accessed sensitive files or caused lasting disruption. It also does not identify the government-affiliated organization. The reported 24 rooted firewalls and the details of the government-network intrusion are attributed to Dream; Unit 42’s independent verification lends support to the account, but the scope of that verification is not detailed here.
It is also unclear how many of the roughly 19,000 devices initially identified were genuinely vulnerable, how many remained exposed after the advisory, and whether further victims have been found. Dream’s report describes a particular set of targets and should not be read as a count of all affected PAN-OS systems.
Administrators Need to Check Exposure
Organizations using affected PAN-OS branches should check Palo Alto Networks’ advisories for the specific fixed versions applicable to their devices and apply updates. Where patching is not yet complete, the reported mitigation is to restrict management access so the interface is not reachable from the public internet. Security teams should also review logs and device state for unexpected accounts, web shells, tunnels or changes to administrator authentication, and investigate internal management systems connected to affected firewalls.
Federal agencies face the remediation direction CISA issued when it added the two PHP2Shell vulnerabilities to its exploited-vulnerability catalog. The next public developments to watch are any further vendor or government findings on affected systems, the confirmed scope of the government-affiliated network intrusion, and whether investigators identify evidence clarifying how the attacker used the AI tools found by Dream. The source material does not state whether additional victims or public advisories are expected.
Key Questions
What happened in the PHP2Shell attack?
Dream says an attacker chained two PHP2Shell vulnerabilities with the Fragnesia Linux kernel flaw to gain root access on 24 PAN-OS firewalls. The report also describes access to an internal firewall-management server at a U.S. government-affiliated organization.
Did AI write or run the exploit?
That has not been established. Dream found AI coding and model tools on the attacker’s systems, but said it had no direct evidence they wrote the exploit or scripts, and said the attack did not appear fully autonomous.
Which vulnerabilities were involved?
The reported chain used CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, together with CVE-2026-46300, the Linux kernel flaw called Fragnesia.
What should Palo Alto firewall administrators do?
Check the vendor’s advisory and install the fixed PAN-OS build for the device and branch in use. Restrict management interfaces from public internet access, and review devices and connected systems for signs of unauthorized access or persistence.
Was data stolen from the government-affiliated organization?
The supplied account does not confirm data theft. Dream reported that the attacker reached an internal management server and went after Active Directory, but the extent and consequences of that activity remain unclear.
Source: ThorstenMeyerAI.com
