🔍 Read the full analysis: Breaking Down The PHP2Shell Attack And Its “AI-Assisted” Label on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream reported that an attacker used two PHP2Shell vulnerabilities and a previously disclosed Linux kernel flaw to gain root access to 24 internet-exposed Palo Alto Networks firewalls, then reach a government-affiliated network and compromise one internal server. Dream found AI tools on the attacker’s infrastructure but says it has no direct evidence they wrote the exploit or scripts. The incident highlights the risk of exposing firewall management pages and the delay before fixes were available for affected PAN-OS branches.
Attackers used PHP2Shell vulnerabilities and a previously disclosed Linux kernel flaw to gain root access to 24 Palo Alto Networks firewalls and compromise one internal server, according to Israeli security firm Dream. Its October 26 report, updated October 29, says the intruders reached a U.S. government-affiliated network and targeted its Active Directory system; Dream found AI tools in the attacker’s environment but says it has no direct evidence those tools produced the exploit.
Dream says the attack began on the evening of October 23, when an automated process tested 240 selected firewalls. The company reported that 24 were compromised with root access. The targeted devices were in the United States, Japan, Taiwan and South Korea. Dream says 22 compromised firewalls were left with a hidden web shell, a way to maintain access.
According to Dream’s timeline, the attacker used the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to run code on the firewall’s management web server, then chained them with Fragnesia (CVE-2026-46300), a Linux kernel privilege-escalation flaw disclosed in May. Dream says the chain allowed the attacker to move from limited access to root privileges and establish persistent access. Palo Alto Networks said its Unit 42 researchers independently verified the attacker’s tools and results.
Dream says two compromised firewalls belonged to the same government-affiliated organization. On October 24, the attacker used one as a route into the organization, compromised an internal firewall-management server and then targeted Active Directory. The report describes 25 servers in total: 24 firewalls and one internal server. The extent of any access to accounts, data or other systems was not established in the supplied account.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Pages Raised Risk
The reported intrusion shows how internet-accessible firewall management pages can turn a newly disclosed software flaw into a fast route to high privileges. A firewall is intended to control network access; its management interface can also provide powerful control over the device and, in some cases, a path toward systems behind it. Dream’s account links the initial firewall compromises to a later breach of an internal management server.
The timing also matters. PHP released fixes on October 21, and Palo Alto Networks issued an advisory that day, but Dream says patched PAN-OS builds for the affected 12.1 and 12.2 branches arrived between October 27 and 29—after the reported attacks. The account says the immediate protective measure before those builds were available was to keep the management interface off the public internet. Organizations using affected equipment faced a window in which exposure and patch availability did not align.
The incident is being described as “AI-assisted,” but that label should not be read as proof that an AI system independently discovered or carried out the attack. The reported evidence points more directly to a familiar combination: exposed administration, known vulnerabilities, automation and a targeted route into an organization’s network.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Apple Watch Series 12 GPS Smartwatch, 46mm
As an affiliate, we earn on qualifying purchases.
Patch Timeline and Attack Chain
Dream’s timeline says Fragnesia was disclosed in May 2026, with a public exploit, and was fixed in the Linux kernel. On October 21, PHP released security updates, while Palo Alto Networks published an advisory for its PAN-OS products and said fixed versions were forthcoming. Dream says the affected firewalls used a vendor-shipped copy of PHP, version 8.0.30.
Before the attack, Dream says the attacker identified about 19,000 PAN-OS firewalls with internet-facing management pages using FOFA, a search service for internet-connected devices. A custom scanner obtained version information from about 5,000; after filtering by location and software version, 240 targets remained. These are figures from Dream’s reconstruction, not a count independently established in the supplied material.
Dream says the automated batch ran from 18:14 to 21:55 UTC on October 23, attacking five targets at a time. It reports that the attacker returned to the government-affiliated organization the next day, established a tunnel and persistence, and then reached the internal management server. Dream found the attacker’s artifacts on October 25 and published its account on October 26. CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26 and set a three-day deadline for federal agencies, according to the source material.
““no direct evidence””
— Dream
AI’s Role and Breach Scope
Dream found Claude Code installed and DeepSeek and Kimi configured in an offensive-security platform called aiscan on the attacker’s servers. That establishes the presence of those tools in the environment, according to the company, but not how they were used. Dream explicitly said it had no direct evidence that AI wrote the exploit or scripts, and its assessment was that the attack did not appear fully autonomous. The “AI-assisted” label is therefore an interpretation of circumstantial evidence, not a demonstrated account of the tools’ contribution.
The supplied report does not establish whether the attacker accessed sensitive information, how many accounts or records may have been exposed, or whether the Active Directory targeting succeeded. It also does not identify the government-affiliated organization. The source says 24 firewalls were rooted and a 25th server was compromised, but the full impact and any later activity remain unclear.
The source material says fixed builds for PAN-OS 12.1 and 12.2 shipped from October 27 through 29, but does not list specific version numbers or establish how quickly affected customers installed them. Those details matter when determining how long vulnerable devices remained exposed after fixes became available.
Patching and Incident Follow-Up
Organizations using affected PAN-OS branches should check Palo Alto Networks’ security advisory for the applicable fixed release and update their devices. Until systems are patched, the reported immediate safeguard is to remove management interfaces from public internet access. Administrators should also investigate exposed devices for unexpected web shells, tunnels, changes to authentication controls and other signs of persistence, following vendor and incident-response guidance rather than relying on the attack report alone.
Federal agencies were given three days after CISA added the PHP2Shell flaws to its exploited-vulnerabilities catalog, according to the source material. The next public developments to watch are further vendor guidance, any additional CISA instructions, and disclosures about the affected organization or the consequences of the Active Directory targeting. The source does not provide a subsequent incident update or confirm whether investigators have completed their review.
Key Questions
What happened in the PHP2Shell attack?
Dream says attackers chained two PHP2Shell flaws with the Linux kernel vulnerability Fragnesia to gain root access to 24 firewalls and compromise one internal server. The activity was reported on October 23 and 24, 2026.
Does the report prove AI created the exploit?
No. Dream found AI tools on the attacker’s servers but said it had no direct evidence they wrote the exploit or scripts. The role of those tools remains unconfirmed.
How did the attacker reach a government-affiliated network?
Dream says two compromised firewalls belonged to the organization. The attacker used one as a route into its network, then compromised an internal firewall-management server and targeted Active Directory. The full extent of access has not been established in the supplied account.
What should organizations using affected firewalls do?
They should consult Palo Alto Networks’ advisory and install the applicable fixed PAN-OS release. The reported interim protection was to keep the firewall management interface off the public internet; organizations should also investigate exposed devices for signs of compromise.
Source: ThorstenMeyerAI.com
