🔍 Read the full analysis: PHP2Shell, Root Access, And AI Assistance: What The Incident Shows on ThorstenMeyerAI.com
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream reported that an attacker combined the PHP2Shell vulnerabilities with a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls. Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results. Dream found AI tools on the attacker’s servers but said it has no direct evidence they wrote the exploit or scripts.
An attacker gained root access on 24 Palo Alto Networks firewalls by chaining the PHP2Shell vulnerabilities with a previously disclosed Linux kernel flaw, according to Israeli security company Dream. The company says the attacker then used compromised equipment to enter a US government-affiliated network and take over an internal server; Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results.
Dream’s account, published October 26 and updated October 29, describes an automated attack on 240 selected firewalls on the evening of October 23, about two days after PHP released fixes for PHP2Shell. The targets were in the United States, Japan, Taiwan and South Korea. Dream says 24 firewalls were compromised, while an additional internal firewall-management server at the government-affiliated organization brought the reported total to 25 servers.
The attacker combined CVE-2026-109618 and CVE-2026-109619, the PHP2Shell flaws, with Fragnesia (CVE-2026-46300), a Linux kernel privilege-escalation bug disclosed in May, according to Dream. The PHP vulnerabilities reportedly allowed command execution under a low-privilege account; Fragnesia then helped the attacker gain administrator-level access. Dream says the attack chain, including installation of a persistent back door, took less than 15 minutes.
Dream reports that 22 of the compromised firewalls were left with hidden web shells. At the government-affiliated organization, the attacker used two compromised firewalls to establish a route to an internal server that manages the organization’s firewalls. Dream says the attacker then targeted Active Directory, which controls access to accounts and network resources. The available account does not establish what information, if any, was accessed or taken.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Pages Raised the Risk
The incident shows how vulnerabilities in a device’s management software can become a route into an organization’s wider network when the management interface is reachable from the internet. The reported sequence joined a web application flaw to an older kernel bug, turning initial command execution into root access. That made compromised firewalls useful not only as targets but also as stepping stones to internal systems.
The timing also highlights a patching gap. PHP published fixes on October 21, but Dream says PAN-OS includes its own PHP version, and patched builds for the affected 12.1 and 12.2 branches arrived between October 27 and 29. Palo Alto Networks had published an advisory on October 21, with fixed versions described as forthcoming. Until an applicable fix was available, keeping the management interface off the public internet was a key protective measure, according to the source account.
Dream’s findings about AI tools have drawn attention, but they do not establish that AI created the exploit chain. The directly described security issues remain internet-exposed administration pages, a known privilege-escalation vulnerability and a delay before fixes reached the affected firewall branches.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From PHP Fixes to Firewall Patches
PHP released corrected versions on October 21, 2026, and Palo Alto Networks issued an advisory that day. Dream says PAN-OS used its own copy of PHP, version 8.0.30, and that fixed versions for the affected 12.1 and 12.2 branches were released from October 27 through October 29. The PHP project’s release did not itself update the PHP component bundled with PAN-OS.
The second flaw in the chain, Fragnesia, was disclosed in May 2026 and had a public exploit, according to the timeline in Dream’s report. Before the October attack, Dream says the attacker identified roughly 19,000 PAN-OS firewalls with internet-facing management pages, obtained version information from about 5,000, and narrowed the pool to 240 targets based on location and software version. These are figures reported by Dream, not a count independently detailed in the supplied material.
On October 26, the US Cybersecurity and Infrastructure Security Agency added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog and set a three-day deadline for federal agencies, according to the source account. The incident therefore followed quickly after the PHP fixes and prompted a federal response while Palo Alto Networks’ firewall updates were still being released.
““no direct evidence””
— Dream
AI Role and Network Impact Remain Unclear
Dream says it found the coding assistant Claude Code installed on the attacker’s servers, along with the AI models DeepSeek and Kimi configured in a security platform called aiscan. The company has not provided direct evidence in the supplied account that those tools generated the exploit, scripts or attack decisions. The term “AI-assisted” should therefore be treated as an interpretation of the tools found, not proof that AI built or autonomously carried out the operation.
It is also unclear from the published details what data the attacker accessed, whether any information was removed, or what happened to the Active Directory system after it was targeted. The source account does not identify the government-affiliated organization, explain whether the attacker retained access after discovery, or provide a complete account of remediation. The reported totals and operational details are attributed to Dream; Palo Alto Networks’ stated independent verification is not accompanied here by a separate incident report.
Patch and Access Reviews Continue
Organizations using the affected PAN-OS branches should check Palo Alto Networks’ current advisories and install the applicable fixed release. They should also review whether firewall management pages are reachable from the public internet and restrict access to trusted networks or approved management paths. Where exposure or compromise is suspected, administrators should investigate for unauthorized accounts, web shells, tunnels and changes that could survive a reboot.
Federal agencies were given three days after CISA’s October 26 catalog action to address the listed PHP2Shell vulnerabilities, according to the source material. Further reporting from Dream, Palo Alto Networks or the affected organization may clarify the scope of the network intrusion, the status of the compromised systems and whether data was accessed. Those details are not established in the account available so far.
Key Questions
What are the PHP2Shell vulnerabilities?
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619. Dream says the flaws enabled command execution on affected firewall management web servers.
How did the attacker obtain root access?
According to Dream, the attacker chained PHP2Shell with Fragnesia (CVE-2026-46300), a Linux kernel privilege-escalation flaw disclosed in May. The combination reportedly turned limited command execution into root access.
Did AI write or run the attack?
That has not been established. Dream found AI tools and models on the attacker’s servers but said it had no direct evidence that they wrote the exploit or scripts, and described the attack as not appearing fully autonomous.
What should PAN-OS administrators do?
Check Palo Alto Networks’ advisory for the relevant fixed release, apply the update, and keep management interfaces off the public internet. Organizations should also investigate for signs of unauthorized access if their systems were exposed.
Was data stolen from the government-affiliated network?
The supplied account says the attacker reached an internal firewall-management server and targeted Active Directory, but it does not confirm whether data was accessed or removed.
Source: ThorstenMeyerAI.com
