🔍 Read the full analysis: PHP2Shell Explained: From Patch To Root Across 25 Palo Alto Servers on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream says an attacker compromised 24 Palo Alto Networks firewalls and one internal firewall-management server in an operation on October 23-24, 2026. The reported chain combined PHP2Shell flaws with a previously disclosed Linux kernel bug; Dream says AI tools were present but found no direct evidence they produced the exploit. Palo Alto says Unit 42 independently verified the attack tools and results.
Security company Dream reported that an attacker gained root access to 24 Palo Alto Networks firewalls and then compromised a 25th server inside a U.S. government-affiliated network on October 23-24, using two PHP flaws and a known Linux kernel bug. Palo Alto Networks said its Unit 42 researchers independently verified the attacker’s tools and results; Dream’s account places the activity shortly after PHP issued fixes and before fixes for affected PAN-OS branches were available.
Dream’s report, published October 26 and updated October 29, describes an automated operation that targeted 240 firewalls and succeeded on 24. The targets were in the United States, Japan, Taiwan and South Korea, according to the company. Dream says the attacker used the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, alongside Fragnesia, a Linux kernel privilege-escalation flaw disclosed in May and tracked as CVE-2026-46300. Dream says the chain allowed initial command execution on a firewall followed by escalation to root.
The reported activity continued into a U.S. government-affiliated organization. Dream says two of the compromised firewalls belonged to that organization; the attacker used one as a route to an internal server used to manage the organization’s firewalls. The internal server was compromised on October 24, and the attacker then targeted Active Directory, which controls access to accounts and resources. Dream says 22 of the 24 affected firewalls were left with hidden web shells. Palo Alto’s independent verification, as described in the source material, applies to the attacker’s tools and results; further public details about the government-affiliated organization have not been provided.
The timing matters because PHP released patched versions on October 21, the same day Palo Alto published an advisory, but Dream says corrected PAN-OS builds for the affected 12.1 and 12.2 branches did not ship until October 27-29. Until those updates were available, Palo Alto advised restricting access to firewall management interfaces, according to the report. Dream says the attack run against the 240 targets took place on October 23, within that interval.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Patch Timing Left Firewalls Exposed
The report highlights a gap between a vulnerability announcement and a vendor fix becoming available for specific affected products. PHP’s upstream patches did not immediately patch PAN-OS, which includes its own PHP copy, Dream says. Customers could not rely on the PHP project’s release alone to update the firewall software; the relevant protection depended on Palo Alto’s PAN-OS updates or limiting access to the management interface.
The reported intrusion also shows the potential consequences of combining flaws with different roles. Dream says PHP2Shell provided a foothold with limited permissions, while Fragnesia enabled escalation to administrator-level access. Reaching the internal firewall-management server then created a path toward a broader organization network. These are findings from Dream’s investigation, not evidence that every exposed firewall was vulnerable or compromised.
For network operators, the practical issue is exposure and remediation: management interfaces reachable from the public internet can create a direct route to security devices that control network traffic. Dream’s account says the attacker selected targets after scanning internet-facing devices and filtering by location and software version. Organizations using affected PAN-OS branches need to check their exposure, apply the vendor’s corrected builds and investigate for persistence where compromise is suspected.
Products Worth Considering
Apple Watch Series 12 GPS Smartwatch, 46mm
Sonos Era 100 SL Compact, Microphone-Free Speaker – Black
Bose QuietComfort Wireless Noise Cancelling Headphones, Sandstone
As an affiliate, we earn on qualifying purchases.
Two Flaws, One Attack Chain
PHP2Shell is the name used in Dream’s report for two critical PHP vulnerabilities. Palo Alto’s firewalls run a vendor-supplied PHP version, identified by Dream as PHP 8.0.30. The report says the management web server ran with limited permissions, so the PHP flaws alone did not provide root access. The attacker paired them with Fragnesia, a Linux kernel flaw that Dream says had been publicly disclosed and fixed in May 2026.
Dream’s timeline says the attacker configured an offensive-security platform called aiscan with DeepSeek and Kimi on October 8. Researchers later found Claude Code installed on the attacker’s servers, along with those model configurations. Dream says this supports the possibility of AI assistance, but it has no direct evidence that AI wrote the exploit or scripts and says the operation did not appear fully autonomous. AI involvement is therefore an inference from tools found, not a demonstrated cause of the compromise.
After PHP published patched releases on October 21, Palo Alto issued an advisory while fixed PAN-OS builds were still pending. Dream says the attacker narrowed an initial pool of roughly 19,000 internet-facing management interfaces to about 5,000 devices that returned version information and then to 240 targets. These figures describe the scanning and filtering in Dream’s account; they do not establish how many devices were vulnerable overall.
““no direct evidence” that AI tools wrote the exploit or the scripts”
— Dream
AI Role and Breach Scope
Several parts of the incident remain unconfirmed in the supplied account. Dream has not shown direct evidence that AI tools authored or materially changed the exploit, and the presence of Claude Code, DeepSeek and Kimi on attacker infrastructure does not establish how they were used. The company’s description of the attack as not fully autonomous is its assessment.
The identity of the attacker, the full extent of access to the government-affiliated network, and whether data was accessed or removed are not specified. The account says Active Directory was targeted, but does not establish what changes, if any, were made to it. It also does not identify the affected organization or provide a complete public list of compromised devices. The reason for the first government-affiliated firewall’s reported crash is uncertain; Dream said the volume of attack traffic may have caused it.
Apply Fixes and Check Access
Organizations should confirm whether their PAN-OS systems ran affected 12.1 or 12.2 versions, install the applicable fixed builds, and keep management interfaces off the public internet where possible. Palo Alto’s advisory and product guidance are the sources for version-specific remediation. Where a device may have been exposed during the attack window, administrators should review logs and investigate for hidden web shells, unexpected administrator access and signs of persistent access.
Further reporting from Palo Alto, Dream or relevant government agencies could clarify the affected organization, the extent of the Active Directory activity and whether information was accessed. The source material says the Cybersecurity and Infrastructure Security Agency added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26 and set a three-day deadline for federal agencies. The status of follow-up investigations and any broader disclosure remains unclear.
Key Questions
What happened in the PHP2Shell incident?
Dream says an attacker used two PHP vulnerabilities together with a Linux kernel flaw to gain root access to 24 Palo Alto firewalls and compromise an internal firewall-management server.
Were 25 firewalls compromised?
No. Dream reports 24 compromised firewalls and one additional internal management server, for 25 affected servers in total.
Did AI create the exploit?
That has not been established. Dream found AI tools and model configurations on the attacker’s servers but said it had no direct evidence that they wrote the exploit or scripts.
Why did PHP’s October 21 fixes not protect the firewalls immediately?
Dream says PAN-OS contained its own PHP version and that fixed builds for the affected 12.1 and 12.2 branches shipped later, between October 27 and 29. Palo Alto’s advisory recommended restricting access to the management interface while fixes were pending.
What should organizations do now?
Check affected PAN-OS versions, install Palo Alto’s applicable fixed builds, restrict management access from the public internet and investigate potentially exposed devices for signs of compromise.
Source: ThorstenMeyerAI.com
