🔍 Read the full analysis: How The PHP2Shell Chain Affected 25 Palo Alto Servers—and Where AI Fits on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Dream reported that an attacker chained PHP2Shell vulnerabilities with a Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls and compromise an internal management server, for 25 servers in total. Palo Alto Networks says Unit 42 independently verified the attacker’s tools and results. AI software was found on the attacker’s infrastructure, but Dream says it has no direct evidence that AI wrote the exploit or scripts.
An attacker used PHP2Shell flaws and a separate Linux kernel vulnerability to gain root access on 24 Palo Alto Networks firewalls, then used one to reach an internal server at a U.S. government-affiliated organization, according to a report by Israeli security company Dream. Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results; Dream counts 25 compromised servers in total.
Dream said the automated attack began on the evening of October 23, roughly two days after the PHP project released fixes for the two vulnerabilities it calls PHP2Shell: CVE-2026-109618 and CVE-2026-109619. The attacker combined them with Fragnesia, a Linux kernel privilege-escalation flaw disclosed in May and identified as CVE-2026-46300. Dream’s account says PHP2Shell enabled command execution on affected firewall management web servers, while Fragnesia was used to obtain root privileges.
According to Dream, the attacker selected 240 targets from a wider set of internet-exposed management interfaces and rooted 24 firewalls across the United States, Japan, Taiwan and South Korea. Twenty-two were left with a hidden web shell, Dream reported. Two compromised firewalls belonged to the U.S. government-affiliated organization. The attacker then used a tunnel through one of them to reach the organization’s internal firewall management server on October 24. Dream says the attacker also targeted Active Directory, the service used to manage accounts and access.
Dream reported finding Claude Code installed on the attacker’s servers, alongside the Chinese AI models DeepSeek and Kimi configured in a security platform called aiscan. The company said it had “no direct evidence” that AI generated the exploit or scripts, and that the activity did not appear to be fully autonomous. The presence of those tools is confirmed in Dream’s report; their role in carrying out the attack is not.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Interfaces Raised the Risk
The incident shows how a publicly reachable firewall management page can turn newly disclosed software flaws into a direct route to administrative control. Firewalls sit between networks, but their management interfaces are used to change access rules and oversee other devices. A compromise of a management server can therefore put more than one machine at risk.
Dream’s account also describes a chain rather than a single vulnerability: one flaw enabled initial command execution, and a separate kernel bug enabled higher privileges. The reported access to Active Directory raises the stakes because that system governs user identities and permissions across an organization. Dream says the attacker went after it; the available source material does not establish the extent of any resulting access or damage.
The AI angle should be read cautiously. AI tools found on an attacker’s infrastructure do not by themselves prove that models built or ran the exploit. Dream’s stated lack of direct evidence leaves that question open. The report’s clearest security implication is more conventional: exposed administration services and unpatched software created opportunities the attacker could exploit.
Popular right now
Vitamix Propel Series 510 Professional-Grade Blender, 3 Programs, Black
Vitamix Propel Series 750 Professional-Grade Blender, 4 Programs, Black
KitchenAid Artisan Series 5-Quart Tilt-Head Stand Mixer, Dried Rose (KSM150PS)
As an affiliate, we earn on qualifying purchases.
Patches Followed the October 21 Advisory
The PHP project released updates on October 21, and Palo Alto Networks published an advisory that day. According to the source account, Palo Alto’s advisory said fixed PAN-OS builds were forthcoming. Dream says the firewalls used the vendor’s own PHP 8.0.30, rather than a separately installed copy of PHP, and that fixed builds for the affected 12.1 and 12.2 branches shipped from October 27 to 29.
That timing matters: Dream places the automated attack on October 23, before those PAN-OS fixes became available. It also says defenders could reduce exposure by keeping the management interface off the public internet. The report describes the attacker finding about 19,000 internet-facing interfaces, obtaining version information from around 5,000, and narrowing the set to 240 targets. These figures are Dream’s account of its investigation, not an independently supplied census of all exposed firewalls.
Fragnesia had been publicly disclosed in May, according to the source material, and a public exploit was available. The attack therefore combined newly patched application flaws with a previously disclosed kernel issue. On October 26, the U.S. Cybersecurity and Infrastructure Security Agency added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog, the source says.
““no direct evidence””
— Dream
AI’s Role and the Damage Remain Unclear
The available reporting does not establish whether AI generated or modified the exploit, scripts, target selection or other parts of the operation. Dream found AI-related software on the attacker’s servers, but explicitly said it lacked direct evidence that the tools produced the attack code. It also assessed that the operation did not appear fully autonomous.
The source material does not detail how much information, if any, was taken from the government-affiliated network, whether the Active Directory attack succeeded, or what remediation the organization completed. It also does not identify the attacker or explain their motive. Palo Alto Networks’ reported independent verification applies to the tools and results, but the supplied account does not specify the scope or methods of that review.
Patch PAN-OS and Restrict Management Access
Organizations using affected PAN-OS versions should check Palo Alto Networks’ security guidance for the applicable fixed release and install it, while reviewing whether firewall management interfaces are reachable from the public internet. Dream’s account identifies restricting that access as a protective measure during the period before fixes were available. Security teams should also investigate systems that may have been exposed and review firewall and identity-system logs for signs of unauthorized access.
The next public developments to watch are any additional vendor or government details about the affected organization, the extent of access to Active Directory, and evidence clarifying whether AI tools contributed to the attack. The source material does not give a date for further findings, so those questions remain open.
Key Questions
How many servers did Dream say were compromised?
Dream reported 24 compromised Palo Alto firewalls and one internal firewall management server reached through a government-affiliated organization’s network, for 25 servers in total.
What vulnerabilities were used?
Dream says the attacker chained the two PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with the Linux kernel flaw Fragnesia, CVE-2026-46300.
Did AI build the exploit?
That has not been established. Dream found Claude Code and DeepSeek and Kimi configured on the attacker’s infrastructure, but said it had no direct evidence that AI wrote the exploit or scripts.
What should firewall operators do?
Operators should check Palo Alto Networks’ guidance for the affected PAN-OS branches, apply the relevant fixed release, and restrict management interfaces so they are not publicly reachable. They should also review logs and investigate any exposure.
Source: ThorstenMeyerAI.com
