🔍 Read the full analysis: How A Two-Day PHP2Shell Chain Compromised Palo Alto Servers on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream reported that an attacker chained two PHP2Shell flaws with the previously disclosed Fragnesia Linux kernel vulnerability to gain root access on 24 Palo Alto Networks firewalls. The activity also reached a firewall-management server inside a U.S. government-affiliated network. Dream found AI tools in the attacker’s environment but said it had no direct evidence they created the exploit or scripts.
Attackers used two newly patched PHP flaws and a previously disclosed Linux kernel vulnerability to gain root access on 24 Palo Alto Networks firewalls and then reach a firewall-management server inside a U.S. government-affiliated network, according to Israeli security company Dream. The reported activity began on October 23, two days after PHP published fixes for the flaws, and highlights the risk of internet-accessible firewall management pages during the gap before vendor fixes were available.
Dream’s account says the attacker ran an automated batch against 240 PAN-OS firewalls on the evening of October 23, targeting systems in the United States, Japan, Taiwan and South Korea. It reports that 24 were compromised with root privileges. Palo Alto Networks said its Unit 42 researchers independently verified the attacker’s tools and results, according to Dream’s report.
The chain combined PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 with Fragnesia, a Linux kernel privilege-escalation flaw tracked as CVE-2026-46300 and made public in May. Dream says PHP2Shell allowed command execution on the firewall’s management web server, while Fragnesia helped the attacker gain administrator-level access. The company reported that 22 of the 24 rooted firewalls were left with a hidden web shell.
Dream says two compromised firewalls belonged to a government-affiliated organization. On October 24, the attacker used one as a route to an internal server responsible for managing the organization’s firewalls, bringing the reported total to 25 compromised servers. Dream also reported subsequent attempts against the organization’s Active Directory, which manages user accounts and access. The source account does not establish what data, if any, was taken or whether those attempts succeeded.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Internet-Facing Management at Risk
The incident shows how a short patching gap can matter when a security device’s management interface is reachable from the public internet. PHP had released fixes on October 21, but Dream says fixed PAN-OS builds for the affected 12.1 and 12.2 branches did not arrive until October 27 to 29. During that period, Palo Alto Networks’ stated protective measure was to keep the management interface off the internet.
Firewalls sit at network boundaries, but their administrative interfaces can provide a route to systems behind them if attackers gain control. The reported move from two firewalls into an internal management server illustrates that risk for organizations that centrally administer devices. The attempted Active Directory access further points to the potential for an intrusion to move from network equipment toward identity systems, although the available account does not confirm a successful takeover of Active Directory.
Dream also identified AI tools in the attacker’s environment, prompting descriptions of the operation as AI-assisted. That detail is not proof that AI generated the exploit or carried out the attack. The confirmed operational concern in the report is the combination of exposed management access, known vulnerabilities and rapid automated targeting.
Products Worth Considering
FLEXISPOT Standing Desk with Monitor Riser & Cable Management
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
Samsung Essential S3 27-Inch Curved FHD Monitor
As an affiliate, we earn on qualifying purchases.
From PHP Fixes to PAN-OS Patches
PHP published updated versions on October 21 to address the PHP2Shell flaws. Palo Alto Networks issued an advisory that day, but the fixed builds for the affected PAN-OS branches were still forthcoming, according to the supplied account. Dream says the affected firewalls used a vendor-packaged copy of PHP, which meant that updating the general PHP project alone did not update PAN-OS installations.
The second flaw in the chain, Fragnesia, had been disclosed in May with a public exploit, Dream says. Before the October attacks, the researchers found roughly 19,000 PAN-OS firewalls with internet-facing management pages using FOFA, a search engine for internet-connected devices. A custom scanner obtained version information from about 5,000, and Dream says filtering by country and software version reduced the list to 240 targets. These figures describe the researchers’ reported discovery and selection process, not a count of all vulnerable firewalls worldwide.
Dream says the attacker prepared the aiscan offensive-security platform with DeepSeek and Kimi models on October 8. Researchers found Claude Code installed on the attacker’s servers as well. Dream published its findings October 26 and updated the report October 29. CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26 and set a three-day deadline for federal agencies, according to the source material.
““no direct evidence””
— Dream
AI Use and Network Impact
Several details remain unresolved in the supplied reporting. Dream says it found Claude Code, DeepSeek and Kimi associated with the attacker’s environment, but says it cannot directly establish that these tools wrote the exploit, generated the scripts or made decisions during the operation. The description of the activity as AI-assisted should be treated as an inference, not a verified account of how the tools were used.
The report also does not specify whether information was exfiltrated, what the attacker did after reaching the internal management server, or whether the Active Directory attacks succeeded. It does not provide a complete count of affected devices beyond the 24 rooted firewalls and one internal server it describes. The available material gives no independent public assessment of the organization’s recovery or the total operational impact.
Patches and Incident Review
Organizations using affected PAN-OS releases should check Palo Alto Networks’ current advisory and apply the fixed builds relevant to their systems. The source account says updates for the 12.1 and 12.2 branches shipped between October 27 and October 29; exact exposure depends on device version and configuration. Where updates cannot be applied immediately, the reported vendor guidance was to keep management access off the public internet.
Administrators should also review firewall and network logs for unexpected management access, web shells, unusual tunnels and attempted access to internal identity services, and follow their incident-response procedures if they find signs of compromise. CISA’s addition of the PHP2Shell flaws to its exploited-vulnerability catalog sets a short response deadline for federal agencies, according to the supplied report. Dream or the affected organization may publish further findings, but no additional technical or impact details are confirmed in the source material.
Key Questions
What happened in the PHP2Shell incident?
Dream reports that an attacker chained two PHP flaws with a Linux kernel vulnerability to gain root access on 24 Palo Alto Networks firewalls. The activity also reached a firewall-management server inside a government-affiliated network.
What are PHP2Shell and Fragnesia?
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, flaws for which PHP released fixes on October 21, 2026. Fragnesia, CVE-2026-46300, is a Linux kernel privilege-escalation vulnerability disclosed in May, according to Dream.
Did AI create the attack?
That has not been established. Dream found AI-related tools and models in the attacker’s environment but said it had no direct evidence they wrote the exploit or scripts. It said the operation did not appear fully autonomous.
What should PAN-OS administrators do?
Check Palo Alto Networks’ advisory for the affected release and install the applicable fixed build. The supplied report says the immediate protective measure before fixed builds were available was to keep the firewall management interface off the public internet.
Was the government-affiliated organization’s Active Directory compromised?
Dream says attackers went after the organization’s Active Directory after reaching an internal firewall-management server. The available account does not confirm that they successfully took over Active Directory or accessed particular data.
Source: ThorstenMeyerAI.com
