🔍 Read the full analysis: A Closer Look At The Two-Day PHP2Shell Attack On Palo Alto Servers on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Dream reported that an attacker used PHP2Shell vulnerabilities and a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, then reached a government-affiliated network’s firewall management server. Palo Alto’s Unit 42 said it independently verified the attacker’s tools and results. Dream found AI tools on the attacker’s servers but says it has no direct evidence they wrote the exploit or scripts.
Attackers gained root access to 24 Palo Alto Networks firewalls in a campaign that began about two days after PHP released fixes for the vulnerabilities known as PHP2Shell, according to Israeli security company Dream. Dream said the attacker then used compromised firewalls to enter a U.S. government-affiliated network and take over an internal server used to manage firewalls; Palo Alto Networks said its Unit 42 researchers independently verified the attacker’s tools and results.
Dream’s account says that on the evening of October 23, an automated operation targeted 240 firewalls. The attacker obtained root access on 24, using the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, together with Fragnesia, a Linux kernel privilege-escalation flaw disclosed in May as CVE-2026-46300. Dream said the full chain, including installation of a persistent back door, could be completed in under 15 minutes. That timing is Dream’s assessment, not an independently established measure of every compromise.
According to Dream, the attackers left 22 of the 24 compromised firewalls with hidden web shells. Two belonged to the same government-affiliated organization. On October 24, the attacker used a tunnel through one of those firewalls to reach the organization’s internal firewall management server, which Dream counted as the 25th compromised server. Dream also reported attempts against the organization’s Active Directory, which controls user accounts and access to network resources. The source account does not establish what data, if any, was taken or what lasting effects followed.
The vulnerabilities were patched in PHP releases on October 21, but PAN-OS uses its own PHP copy, Dream said. Palo Alto Networks issued an advisory that day, while fixed builds for the affected 12.1 and 12.2 branches arrived between October 27 and 29, according to the supplied account. Dream said the campaign selected targets from a larger pool of internet-facing management pages, filtering by country and software version before attacking 240. Its reported target locations were the United States, Japan, Taiwan and South Korea.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Pages Raised the Risk
The reported sequence matters because it links a short gap between vulnerability disclosure and exploitation with a broader exposure problem: firewall management interfaces reachable from the internet. A firewall is meant to control network access, but compromise of its administrative interface can give an attacker a foothold in the systems that enforce those controls. Reaching a central management server can extend the consequences beyond one appliance.
The incident also shows why patch status alone may not capture exposure. The PHP fixes were available before the reported attack, but Palo Alto’s affected PAN-OS branches did not receive fixed builds until later. During that interval, the vendor’s advice, as described in the source material, was to keep the management interface off the public internet. For organizations running affected versions, restricting access to management pages and checking for signs of compromise are relevant defensive steps, alongside applying the vendor’s fixes.
Dream’s report also described the attacker as using AI tools, but that label should not be mistaken for proof that AI built or operated the attack. The reported evidence is the presence of tools and configurations on attacker-controlled servers. Dream said it had no direct evidence that AI generated the exploit or scripts. The confirmed security concern is the reported compromise and the exposure of administrative interfaces, not a demonstrated new capability of autonomous AI.
Products Worth Considering
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Patches and the Attack Timeline
Fragnesia was disclosed in May 2026, with a public exploit, and was assigned CVE-2026-46300, according to the source account. The attacker reportedly set up an offensive-security platform called aiscan on October 8, configured with the models DeepSeek and Kimi. Dream’s timeline places the PHP project’s patched releases and Palo Alto’s advisory on October 21. The firewall campaign followed on October 23 and 24.
Dream said its researchers found artifacts from the operation on October 25 and published their findings on October 26, updating the report on October 29. The company also reported finding Claude Code installed on the attacker’s servers, in addition to the DeepSeek and Kimi configurations. Separately, the supplied material says the U.S. Cybersecurity and Infrastructure Security Agency added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26 and set a three-day deadline for federal agencies.
The account describes a progression from roughly 19,000 internet-facing management pages identified to about 5,000 that returned version information and, after filtering, 240 selected targets. These figures are Dream’s reported findings; the source does not provide an independent census or explain how many of the initially identified devices were vulnerable. Palo Alto’s Unit 42 verification supports the account of the tools and results, but does not by itself resolve every detail of the broader target-selection process.
““no direct evidence””
— Dream
Scope and AI Role Remain Unsettled
Several important details are not established in the supplied reporting. Dream’s account identifies a government-affiliated organization but does not name it, and it does not specify what information the attacker accessed, whether any data was removed, or whether the Active Directory attacks succeeded. The report also does not establish the full impact on the organization or whether all affected systems were recovered.
The AI connection remains limited to evidence that AI tools were present or configured on attacker-controlled servers. Dream said it could not directly show that those tools produced the exploit or scripts, or that they controlled the operation. The precise contribution, if any, of those systems is unknown. The reported number of compromised devices and the attacker’s wider activity are based chiefly on Dream’s investigation; the source material does not provide a public independent account from the affected organization or a complete vendor incident report.
Fixes and Incident Checks Continue
The immediate next steps for operators are to identify affected PAN-OS versions, install the applicable fixed builds, and restrict management interfaces to trusted networks rather than exposing them publicly. Organizations should also review firewall and network logs for suspicious administrative access, web shells, unexpected tunnels and changes to account controls. Because Dream reported persistent access on compromised devices, patching alone may not establish that a system is clean; affected organizations may need to investigate and follow vendor guidance on remediation.
The supplied report says fixed builds for the affected 12.1 and 12.2 branches shipped from October 27 through 29. It also says federal agencies were given three days after CISA’s October 26 catalog action to address the PHP2Shell vulnerabilities. Public confirmation of the government-affiliated organization’s identity, the outcome of the Active Directory activity, and the complete scope of the intrusions was not included in the source material. Further vendor, agency or victim disclosures would clarify those points.
Key Questions
What was PHP2Shell?
PHP2Shell refers to two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, for which the PHP project released fixes on October 21, 2026. Dream said the attacker combined them with the Fragnesia Linux kernel flaw to gain root access on targeted firewalls.
How many systems did Dream say were compromised?
Dream reported 24 Palo Alto firewalls gained root access, followed by an internal firewall management server in a government-affiliated network, bringing the reported total to 25 servers. The number comes from Dream’s investigation.
Did AI create or run the attack?
That has not been established. Dream found AI tools and model configurations on the attacker’s servers, but said it had no direct evidence that AI wrote the exploit or scripts and that the operation did not appear fully autonomous.
What should organizations do?
Organizations should apply the fixed PAN-OS versions that match their deployments, keep management interfaces off the public internet, and investigate for signs of persistence or unauthorized access. Affected operators should follow Palo Alto Networks’ current remediation guidance.
Source: ThorstenMeyerAI.com
