🔍 Read the full analysis: Two Days From Patch To Root: Understanding The Palo Alto PHP2Shell Attack on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream reported that an attacker used PHP2Shell vulnerabilities and a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, then reached a US government-affiliated network. Palo Alto Networks said its Unit 42 researchers independently verified the attacker’s tools and results. Dream found AI tools on the attacker’s servers but said it had no direct evidence that AI wrote the exploit or scripts.
An attacker rooted 24 Palo Alto Networks firewalls in an automated campaign on October 23, about two days after PHP released fixes for vulnerabilities known as PHP2Shell, according to Israeli security company Dream. Dream said the attacker then used compromised firewalls to access a US government-affiliated network and take over an internal server; Palo Alto Networks said its Unit 42 researchers independently verified the attacker’s tools and results.
Dream’s account says the attacker targeted 240 firewalls and gained root access on 24. The targets were in the United States, Japan, Taiwan and South Korea. The campaign combined the PHP2Shell flaws, identified as CVE-2026-109618 and CVE-2026-109619, with Fragnesia, a Linux kernel privilege-escalation vulnerability disclosed in May as CVE-2026-46300. The chain reportedly allowed the attacker to move from executing commands with limited privileges to gaining administrator-level access.
Dream said 22 of the 24 firewalls were left with hidden web shells. Two belonged to a US government-affiliated organization. According to the company, the attacker used those firewalls to reach the organization’s internal firewall-management server on October 24, bringing the reported total of compromised servers to 25. Dream also reported subsequent attempts against the organization’s Active Directory, which controls user accounts and access. The source account does not establish the extent or outcome of those attempts.
The timing of the fixes is a central part of the report. PHP released corrected versions on October 21, and Palo Alto Networks issued an advisory that day, but Dream said fixed PAN-OS builds for the affected 12.1 and 12.2 branches arrived between October 27 and 29. Until those builds were available, Palo Alto’s recommended protection was to keep the management interface off the public internet. Dream said its researchers identified about 19,000 internet-facing management pages, narrowed the pool to 240 targets by version and location, and observed attacks against those targets.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Pages Enabled Access
The reported incident shows how a patch release does not immediately protect devices when vendors still need to issue and deploy fixes for their own software builds. Dream said the targeted PAN-OS firewalls included a vendor-distributed copy of PHP, so the availability of upstream PHP fixes on October 21 did not mean that patched PAN-OS versions were already ready to install. Organizations using affected devices faced a period when restricting access to the management interface was a key protective step.
The alleged move from perimeter firewalls to an internal management server matters because such systems can provide access to many other network devices. Dream reported that the attacker also went after Active Directory, potentially putting account and access controls in scope. The report does not say that the attacker successfully took over the directory, and readers should not treat that attempt as a confirmed compromise.
Dream also found AI-related tools on infrastructure it attributed to the attacker, including Claude Code and the DeepSeek and Kimi models configured in an offensive-security platform called aiscan. That discovery does not establish that AI created the exploit or automated the intrusion. The confirmed security concern in the report is the combination of exposed management interfaces, known vulnerabilities and delayed availability of patched firewall builds.
Products Worth Considering
Dell P2725H 27-Inch Full HD Monitor
Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB
Samsung 34-Inch ViewFinity S50GC Ultra-WQHD Monitor
As an affiliate, we earn on qualifying purchases.
From PHP Fixes to PAN-OS Builds
The vulnerabilities were used in a chain rather than as a single flaw. As Dream describes it, PHP2Shell enabled command execution on the firewall’s management web server, initially with limited privileges. Fragnesia, a kernel bug for which a public exploit had been disclosed in May, was then used to raise those privileges to root. This summary describes the reported sequence without providing operational instructions.
Dream’s timeline says the attacker configured aiscan with DeepSeek and Kimi on October 8. Before the October 23 campaign, the attacker reportedly identified exposed management interfaces, checked versions and selected targets. Dream says the attack ran in batches of five and lasted from 18:14 to 21:55 UTC. The first firewall associated with the government-affiliated organization was compromised that evening; a second was accessed the following morning, before the internal management server was reached.
Dream published its findings on October 26 and updated them on October 29. On October 26, the US Cybersecurity and Infrastructure Security Agency added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog and set a deadline for federal agencies, according to the supplied material. Palo Alto’s fixed builds for the affected branches followed between October 27 and 29, as reported by Dream.
““no direct evidence” that AI tools wrote the exploit or scripts”
— Dream
AI Use and Network Impact
The available account does not establish whether AI helped write or adapt the exploit, choose targets, or automate any part of the campaign. Dream said it found Claude Code and configured DeepSeek and Kimi models, while also stating it had no direct evidence those tools produced the exploit or scripts. The degree of human involvement remains unclear.
Other details also remain unresolved in the supplied reporting. Dream reported attacks against Active Directory but did not specify whether the attacker gained control of it, what information may have been accessed or removed, or whether the organization detected additional persistence. The account identifies the victim only as a US government-affiliated organization and does not name it. It also does not provide a complete account of remediation across all affected firewall owners.
The reported numbers and sequence are attributed to Dream, with Palo Alto Networks’ Unit 42 said to have independently verified tools and results. The source material does not include the underlying technical report or a direct government statement confirming the scope of the incident. Those limits matter when distinguishing a reported intrusion and attempted activity from a fully established account of downstream damage.
Patch and Restrict Management Access
Owners of affected PAN-OS devices should consult Palo Alto Networks’ advisories and determine whether their software branch has a fixed build available. The protective measure cited in the report while fixes were pending was to keep the management interface off the internet. Organizations should also review access to firewall-management systems and investigate whether exposed devices show signs of compromise; this is general security context, not a claim that every exposed device was attacked.
Further reporting would need to clarify the government-affiliated organization’s findings, the outcome of the reported Active Directory activity and whether any data or additional systems were affected. It may also establish whether AI tools played a direct role in the campaign. For now, Dream’s account documents a reported, rapid exploitation chain and a vendor-confirmed investigation, while important questions about impact and attacker methods remain open.
Key Questions
What was PHP2Shell?
PHP2Shell is the name used for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Dream says the attacker combined them with the Fragnesia Linux kernel flaw to move from limited command execution to root access on targeted firewalls.
How many systems did Dream report as compromised?
Dream reported root access on 24 Palo Alto firewalls and access to one internal firewall-management server, for 25 servers in total. It said the targets were located in four countries.
Did AI create the attack?
That is not established. Dream found AI tools and configured models on attacker infrastructure but said it had no direct evidence they wrote the exploit or scripts.
What should owners of affected firewalls do?
Check Palo Alto Networks’ advisories for the appropriate fixed PAN-OS build and restrict management interfaces from public internet access. Dream identified limiting exposure as the protection available while fixes for the affected branches were pending.
Source: ThorstenMeyerAI.com
