🔍 Read the full analysis: How PHP2Shell Led To Root Access Across 25 Palo Alto Servers on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Dream reported that an attacker exploited PHP2Shell and a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, then reach a 25th server on a U.S. government-affiliated network. Palo Alto Networks says Unit 42 independently verified the attacker’s tools and results. Dream found AI tools on the attacker’s infrastructure but says it has no direct evidence that they wrote the exploit or scripts.
Attackers used two software vulnerabilities to gain root access on 24 Palo Alto Networks firewalls and then compromise an internal management server on a U.S. government-affiliated network, according to a report published by Israeli security company Dream on October 26. Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results; Dream’s account also describes subsequent activity against the organization’s Active Directory system.
Dream said the attacker combined PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 with Fragnesia, a Linux kernel privilege-escalation flaw, CVE-2026-46300. PHP2Shell provided initial command execution on the firewall, while Fragnesia was used to gain administrator-level root access. Dream said the attacker’s automated batch targeted 240 firewalls on the evening of October 23 and succeeded on 24. The targets were in the United States, Japan, Taiwan and South Korea.
Dream’s timeline says that, on October 24, the attacker compromised a second firewall belonging to a U.S. government-affiliated organization, established a tunnel into its network and reached an internal server used to manage the organization’s firewalls. Dream counted that machine as the 25th compromised server. The report says the attacker then targeted Active Directory, which controls authentication and access to organizational systems. Dream reported that 22 of the 24 compromised firewalls were left with a hidden web shell.
The timing mattered: PHP released fixes for the PHP vulnerabilities on October 21, and Palo Alto Networks published an advisory that day, but Dream said fixed PAN-OS builds for the affected 12.1 and 12.2 branches arrived between October 27 and 29. Dream said attackers exploited firewalls before those builds were available. It described the full chain as taking less than 15 minutes, a timing estimate attributed to the company’s analysis.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Firewall Panels Became Entry Points
The report shows how a firewall intended to protect a network can become an entry point when its management interface is accessible from the internet and vulnerable software is exposed. A successful compromise can give an intruder control over the device’s configuration and provide a route toward other systems, as Dream says happened when the attacker reached an internal firewall-management server.
The incident also highlights the gap between announcing a vulnerability and having a vendor’s affected product builds ready to install. Dream said the PHP project had issued fixes, but the relevant PAN-OS updates followed several days later. During that interval, organizations needed to limit exposure of management interfaces and follow vendor guidance. The report’s account of activity against Active Directory adds a further concern: compromised network infrastructure may enable attempts to access identity systems, not just the firewall itself.
For defenders, the immediate relevance is practical: check whether management interfaces are internet-facing, identify affected software versions, apply vendor fixes and investigate systems for signs of unauthorized access. Dream’s findings describe a particular incident, not proof that every exposed firewall was attacked or compromised.
Products Worth Considering
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Amazon Kindle Scribe Colorsoft 64GB (1st Generation)
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
As an affiliate, we earn on qualifying purchases.
Two Vulnerabilities, One Attack Chain
PHP2Shell refers to two critical vulnerabilities for which the PHP project released fixes on October 21. Dream said PAN-OS uses its own bundled PHP component, which meant that updating the standalone PHP project did not by itself update the affected firewalls. Palo Alto Networks published its advisory on the same date; according to Dream, fixed versions for the affected PAN-OS branches were released from October 27 through October 29.
The attacker also used Fragnesia, CVE-2026-46300, a Linux kernel vulnerability that Dream says had been publicly disclosed and fixed in May. In Dream’s account, PHP2Shell enabled initial code execution, and Fragnesia then provided a path from limited access to root. Combining separate flaws in this way can turn a foothold into control of a device, especially when the device’s management service is reachable from outside the organization.
Dream said its researchers found roughly 19,000 firewalls with internet-facing management pages through an internet-connected-device search service. Its scanning and filtering process narrowed that pool to 240 targets for the reported automated batch. Those numbers describe the research and targeting funnel in Dream’s account; they do not establish that all 19,000 devices were vulnerable or compromised.
“Dream said it had “no direct evidence” that AI tools wrote the exploit or scripts.”
— Dream
AI Role and Intrusion Scope
The presence of AI-related software does not establish how it was used. Dream said it found Claude Code installed and the Chinese models DeepSeek and Kimi configured in a platform called aiscan, but said it had no direct evidence that AI tools produced the exploit or scripts. The extent of any assistance, if there was any, remains unknown.
Some aspects of the incident also remain unconfirmed in the supplied reporting. Dream’s findings concern the systems it identified, and the material does not establish the attacker’s identity or whether the attacker accessed or removed data. The report says activity targeted Active Directory, but does not specify the full impact on accounts, services or the organization. The exact exposure and compromise status of other internet-facing firewalls are not established by the 19,000-device estimate.
Patch, Restrict, and Investigate
Organizations using affected PAN-OS branches should consult Palo Alto Networks’ current advisory, install the applicable fixed build and restrict management access to trusted networks, following vendor instructions. Where management pages were exposed, security teams should review firewall and network logs for suspicious access, check for persistence and assess whether connected management systems or identity services were reached.
The U.S. Cybersecurity and Infrastructure Security Agency added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26, according to the source material. Federal agencies were given three days to address the vulnerabilities under the catalog’s requirements. The next confirmed details to watch for are further vendor or government advisories, findings about the affected organization’s systems and any additional evidence clarifying the attacker’s use of AI tools.
Key Questions
What were PHP2Shell and Fragnesia used for?
Dream said PHP2Shell gave the attacker initial command execution on affected firewalls, while the Linux kernel flaw Fragnesia was used to escalate access to root.
How many systems did Dream say were compromised?
Dream reported root access on 24 firewalls and access to a 25th machine, an internal server used to manage firewalls at a U.S. government-affiliated organization.
Did AI write the exploit?
That has not been established. Dream found AI tools and model configurations on the attacker’s infrastructure, but said it had no direct evidence that they wrote the exploit or scripts.
What should Palo Alto Networks customers do?
Customers should check Palo Alto Networks’ advisory for affected versions and fixes, install the applicable update, restrict management interfaces to trusted access and investigate exposed systems for signs of compromise.
Source: ThorstenMeyerAI.com
