🔍 Read the full analysis: Two Days From Patch To Root: The PHP2Shell Chain Behind 25 Palo Alto Server Takeovers on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream says an attacker exploited PHP2Shell and a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, then compromised a 25th server inside a U.S. government-affiliated network. Palo Alto Networks says its Unit 42 researchers independently verified the tools and results. Dream found AI tools in the attacker’s environment but says it has no direct evidence they wrote the exploit or scripts.
An attacker used PHP2Shell and a known Linux kernel vulnerability to gain root access to 24 Palo Alto Networks firewalls, then used one organization’s compromised firewalls to reach an internal server, according to a report by Israeli security company Dream. Palo Alto Networks said its Unit 42 researchers independently verified the attacker’s tools and results; Dream says the incident affected targets in the United States, Japan, Taiwan and South Korea.
Dream’s account says the attacker ran an automated batch against 240 firewalls on October 23, about two days after the PHP project released fixes for two critical flaws collectively called PHP2Shell. The attacker obtained root access on 24 devices. Dream says the full chain, including installation of a persistent back door, took less than 15 minutes on targeted systems. These timing and compromise details come from Dream’s investigation, rather than a public incident report from each affected organization.
The chain combined PHP2Shell, identified as CVE-2026-109618 and CVE-2026-109619, with Fragnesia, a Linux kernel privilege-escalation flaw tracked as CVE-2026-46300. According to Dream, PHP2Shell allowed command execution on the firewall’s management web server under a low-privilege account. Fragnesia then helped the attacker elevate access to root. Dream says the attacker left hidden web shells on 22 of the 24 rooted firewalls.
Two compromised firewalls belonged to a U.S. government-affiliated organization, Dream reported. On October 24, the attacker used one firewall as a route into the organization’s network, compromised its internal firewall-management server—bringing the reported total to 25 servers—and then targeted Active Directory, which manages access and accounts. Dream says a tunnel and persistence mechanism were in place before the internal server was compromised. The source material does not identify the organization.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Internet-Exposed Management Put Networks at Risk
The incident shows how a newly patched application flaw can become an urgent operational risk when affected devices expose their management interfaces to the public internet. In Dream’s account, initial access was only one step: a separate, publicly known kernel flaw turned limited command execution into root privileges, and compromised firewalls then provided a path toward internal infrastructure.
For network operators, a firewall is not just a boundary device if its administrative interface can be reached from outside. A compromised firewall can expose configuration and network access, and may offer an attacker a route to systems behind it. Dream’s reported access to an internal management server and subsequent targeting of Active Directory underline the possible consequences beyond the firewall itself. The report does not establish what data, if any, was accessed or removed.
The timing also matters. Palo Alto Networks issued an advisory on October 21, but Dream says corrected builds for the affected PAN-OS 12.1 and 12.2 branches were released from October 27 through October 29. During the period before fixes were available, Palo Alto’s recommended protection was to keep the management interface off the internet. Administrators should follow the vendor’s current guidance for their specific version and exposure.
Popular right now
KitchenAid Artisan 5-Qt Tilt-Head Stand Mixer – Almond Cream (KSM150PS)
Samsung 85-Inch QN70H Neo QLED 4K Smart TV (2026)
Vitamix Propel Series 510 Professional-Grade Blender, 3 Programs, Black
As an affiliate, we earn on qualifying purchases.
From PHP Fixes to Firewall Updates
The PHP project released fixes on October 21 for the two PHP2Shell vulnerabilities. Palo Alto Networks published an advisory the same day and described fixed PAN-OS builds as forthcoming, according to the source account. Dream says PAN-OS includes its own copy of PHP, version 8.0.30, and that fixes for the affected 12.1 and 12.2 branches arrived between October 27 and 29.
Fragnesia was a separate, previously disclosed Linux kernel flaw. The source account places its public disclosure and release of an exploit in May 2026, months before the October firewall attacks. Dream says its researchers identified roughly 19,000 PAN-OS devices with internet-facing management pages, obtained version responses from about 5,000, and narrowed the set to 240 targets based on country and software version. These figures describe Dream’s reported scanning and target selection, not a count of confirmed vulnerable devices worldwide.
Dream says it found the attacker’s environment and artifacts on October 25 and published its findings on October 26, updating the report on October 29. On October 26, the U.S. Cybersecurity and Infrastructure Security Agency added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog and set a three-day deadline for federal agencies, according to the supplied material.
““no direct evidence” that AI tools wrote the exploit or scripts”
— Dream
AI Role and Intrusion Impact Remain Unclear
Dream found the coding assistant Claude Code installed and the Chinese AI models DeepSeek and Kimi configured in an offensive-security platform called aiscan. Those findings show that AI tools were present in the attacker’s environment; they do not establish that AI wrote or tested the exploit, selected targets, or carried out the intrusion. Dream explicitly says it has no direct evidence that the tools produced the exploit or scripts.
The public account also leaves important incident details unresolved. The affected government-affiliated organization is not named, and the source material does not describe what information the attacker accessed, whether it was copied, or whether the Active Directory attack succeeded. It is also not clear whether all 24 firewalls remained compromised after the report, how many owners have completed remediation, or whether other affected organizations have disclosed incidents.
Palo Alto’s reported verification supports the account of the tools and results, but it does not answer those open questions. The reported target counts and attack sequence are attributed to Dream; a public forensic accounting from the affected organizations is not included in the supplied material.
Patch, Restrict Access, Check for Persistence
Organizations using affected PAN-OS releases should consult Palo Alto Networks’ current advisory, install the corrected build for their software branch, and keep management interfaces inaccessible from the public internet. Where exposure occurred, operators should investigate for unauthorized accounts, web shells, tunnels, configuration changes and other signs of persistence rather than treating a software update alone as proof that a device is clean.
Organizations connected to compromised firewalls should also review access to internal management systems and Active Directory, and determine whether credentials or other systems require remediation. Federal agencies were given a three-day deadline after CISA added the PHP2Shell vulnerabilities to its exploited-vulnerability catalog, according to the source material. Further public updates from Palo Alto, Dream, CISA or affected organizations could clarify the scope of the intrusion and whether data was accessed or systems remain at risk.
Key Questions
What does PHP2Shell refer to in this report?
PHP2Shell is the name used for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. Dream says the attacker used them to run commands on vulnerable Palo Alto firewall management servers.
How did the attacker obtain root access?
According to Dream, PHP2Shell provided command execution under a low-privilege account. The attacker then chained it with Fragnesia, a Linux kernel flaw, to elevate privileges to root.
Were AI tools confirmed to have built the attack?
No. Dream found Claude Code, DeepSeek and Kimi-related tools in the attacker’s environment, but said it had no direct evidence that AI wrote the exploit or scripts. The company also said the attack did not appear fully autonomous.
What should Palo Alto firewall operators do?
Operators should check Palo Alto Networks’ current advisory and install the fixed PAN-OS version appropriate for their branch. The source account also says the vendor recommended keeping the management interface off the internet while fixes were pending; exposed devices should be checked for signs of persistence.
What is still unknown about the government-affiliated network?
The organization has not been identified in the supplied account. It is also unclear whether the attacker successfully accessed or removed data, whether the Active Directory attack succeeded, and how many affected systems have since been fully remediated.
Source: ThorstenMeyerAI.com
