🔍 Read the full analysis: A Two-Day Route From Patch To Root: The PHP2Shell Palo Alto Case on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream reported that an attacker used PHP2Shell and a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, then entered a U.S. government-affiliated network through two of them. Palo Alto Networks says its Unit 42 researchers independently verified the tools and results. Dream found AI tools on attacker systems but says it has no direct evidence they created the exploits or scripts.
Attackers gained root access to 24 Palo Alto Networks firewalls and used two compromised devices to enter a U.S. government-affiliated network, according to a report published by Israeli security company Dream on October 26. The attack came about two days after PHP released fixes for the flaws Dream calls PHP2Shell; Palo Alto Networks says its Unit 42 team independently verified the attackers’ tools and results.
Dream’s October 29 update says the attacker targeted 240 firewalls in the United States, Japan, Taiwan and South Korea in an automated campaign on October 23. Dream reports that 24 were compromised with root access. Twenty-two were left with a hidden web shell, while two belonged to the government-affiliated organization. Through those devices, the attacker reached the organization’s internal firewall-management server, which Dream counts as the 25th compromised server.
Dream says the attacker chained two PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with Fragnesia, a Linux kernel privilege-escalation flaw assigned CVE-2026-46300. The PHP flaws provided a route to run code on the firewall’s management web server; Dream says the kernel flaw then enabled the attacker to elevate privileges to root. The report says the chain could be completed in under 15 minutes. This is a description of Dream’s findings, not a claim that every exposed device was vulnerable or compromised.
Dream’s timeline says the attacker began probing exposed devices after PHP issued updates on October 21. It describes an initial attack batch from 18:14 to 21:55 UTC on October 23, followed by a targeted intrusion into the government-affiliated network the next day. Dream says the attacker installed a tunnel and persistence on a second firewall before accessing the internal management server and targeting Active Directory, the organization’s system for managing accounts and access.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Pages Became Entry Points
The report highlights how a security appliance can become an entry point into the network it is meant to protect when its management interface is reachable from the internet. In this case, Dream says known vulnerabilities were chained: one enabled code execution, and another elevated access to root. Compromise of firewall-management systems can give an intruder a route to broader network administration and identity systems.
Timing also matters. PHP released fixes on October 21, but Dream says PAN-OS contains its own PHP build, and Palo Alto’s advisory initially listed fixed PAN-OS versions as forthcoming. According to the source material, fixed builds for the affected 12.1 and 12.2 branches were released between October 27 and 29. In the intervening period, Palo Alto advised keeping management access off the public internet. The episode shows why a fix in an upstream component does not by itself patch every product that includes that component.
The “AI-assisted” label is less certain than the vulnerability and intrusion details. Dream found Claude Code installed and DeepSeek and Kimi configured in an offensive-security platform called aiscan. But the company says it has no direct evidence those tools wrote the exploit or scripts. The confirmed security concern is the reported compromise; AI’s role remains an inference, not an established explanation for how it was carried out.
Products Worth Considering
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Amazon Kindle Scribe Colorsoft 64GB (1st Generation)
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
As an affiliate, we earn on qualifying purchases.
PHP Fixes And PAN-OS Update Timing
PHP2Shell refers in Dream’s report to two vulnerabilities in PHP. On October 21, the PHP project released updates for versions 8.5, 8.4, 8.3 and 8.2 and urged users to update. Palo Alto Networks published an advisory the same day, but the source account says the vendor’s affected PAN-OS branches did not receive fixed builds until October 27–29. The difference reflects the need for product vendors to incorporate and release fixes for software bundled with their systems.
The attacker also used Fragnesia, a Linux kernel flaw disclosed in May 2026, according to the source material. Its public disclosure preceded the October campaign by several months. Dream says it found roughly 19,000 PAN-OS devices with internet-facing management pages through FOFA, a search engine for internet-connected devices. A custom scanner reportedly obtained version information from about 5,000, after which the attacker narrowed the pool to 240 targets. These figures describe Dream’s account of the attacker’s selection process; they do not establish that all 19,000 devices were vulnerable.
On October 26, the U.S. Cybersecurity and Infrastructure Security Agency added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog and gave federal agencies three days to act, according to the source material. That government response followed Dream’s October 26 publication and came before the report’s October 29 update.
““We have no direct evidence” that AI tools wrote the exploit or scripts.”
— Dream
AI’s Role And Intrusion Scope
Dream’s report does not establish whether AI tools generated any part of the exploit, scanning code or attack scripts. Finding Claude Code installed and DeepSeek and Kimi configured on attacker systems shows that the tools were present, but not how they were used. Dream explicitly says it has no direct evidence of AI authorship and does not believe the operation was fully autonomous.
The source material does not identify the government-affiliated organization or provide a complete account of the data, systems or accounts accessed after the attacker reached Active Directory. It also does not state whether the attacker maintained access after discovery, whether all affected firewall owners were notified, or how many of the 240 targets were patched or otherwise secured. The reported 19,000 exposed devices should not be treated as 19,000 confirmed vulnerable systems.
Patch Deployment And Incident Review
Organizations running affected PAN-OS versions should follow Palo Alto Networks’ current security advisory, install the appropriate fixed build and restrict management interfaces from public access. The source material says fixes for the 12.1 and 12.2 branches appeared between October 27 and 29. Operators should also review firewall and identity-system logs for signs of unauthorized access; the report does not specify a single indicator that would rule out compromise.
Federal agencies were given three days after CISA’s October 26 catalog action to address the listed vulnerabilities, according to the source material. Further reporting or vendor and government notices may clarify the affected organization, the extent of any access to accounts or data, and whether the attacker’s persistence was removed. Until those details are published, the number of confirmed compromised systems and the role of AI should be kept distinct from the broader set of devices Dream says it identified as exposed.
Key Questions
What does PHP2Shell refer to in this report?
It is Dream’s name for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Dream says they were combined with the Linux kernel flaw Fragnesia, CVE-2026-46300, to gain root access on targeted firewalls.
How many systems did Dream say were compromised?
Dream reports 24 firewalls with root access and one internal firewall-management server reached through a government-affiliated organization’s compromised firewalls, for 25 servers in total. The report separately describes a larger pool of exposed devices; exposure is not the same as confirmed compromise.
Did AI write the attack?
That has not been established. Dream found Claude Code and configurations for DeepSeek and Kimi on attacker systems, but says it has no direct evidence that AI tools wrote the exploit or scripts.
Why did the PHP update not immediately fix the firewalls?
According to the source material, PAN-OS includes its own PHP build, so a PHP project release did not itself update the firewall software. Palo Alto published an advisory on October 21, while fixes for the affected 12.1 and 12.2 branches were released between October 27 and 29.
What should organizations do?
Install the fixed PAN-OS build that applies to the device, keep management interfaces off the public internet, and review systems and logs for signs of compromise. Organizations should follow current vendor guidance because the reported campaign involved both firewall devices and an internal identity-management environment.
Source: ThorstenMeyerAI.com
