🔍 Read the full analysis: What Happened Between Patch And Root In The Palo Alto PHP2Shell Attack? on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream reported that an attacker used PHP2Shell flaws and a previously disclosed Linux kernel vulnerability to gain root access on 24 Palo Alto Networks firewalls on Oct. 23, two days after PHP fixes were released. Palo Alto’s Unit 42 said it independently verified the attacker’s tools and results. Dream found AI tools on the attacker’s servers but said it has no direct evidence that AI wrote the exploit or scripts.
Two days after PHP fixes were released, an attacker used two PHP2Shell vulnerabilities together with a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, according to an investigation published by Israeli security company Dream. The attacker then used compromised equipment to enter a U.S. government-affiliated network and take control of an internal firewall-management server, raising concerns about exposed management interfaces and the delay before fixes for affected PAN-OS versions became available.
Dream’s account, published Oct. 26 and updated Oct. 29, describes an automated attack on 240 selected firewalls on the evening of Oct. 23. The company says the attacker obtained root access on 24 devices. The targets were in the United States, Japan, Taiwan and South Korea. Dream reported that 22 of the compromised firewalls were left with hidden web shells, while two belonged to a U.S. government-affiliated organization.
According to Dream, the attacker used PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 to run code on the firewall’s management web server, then chained that access with Fragnesia, a Linux kernel privilege-escalation vulnerability tracked as CVE-2026-46300. Dream says the PHP flaws initially provided access as a low-privilege user; the kernel flaw was then used to obtain root access. This sequence matters because fixing one component does not necessarily stop an attacker who can combine it with another vulnerability.
Dream says that on Oct. 24 the attacker used a tunnel through two compromised firewalls to reach an internal server used to manage the organization’s firewalls, making it the 25th server compromised in the reported activity. The attacker then targeted the organization’s Active Directory, which controls user accounts and access to network resources. Palo Alto Networks says its Unit 42 researchers independently verified the attacker’s tools and results. The companies have not publicly established the extent of any data access or the full effect of the Active Directory activity.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Interfaces Raised the Risk
The report’s most direct security implication is that a firewall’s management interface can become an entry point when it is reachable from the public internet and vulnerable software is present. Dream says it identified about 19,000 internet-facing management pages, used a scanner to obtain version information from about 5,000, and narrowed its attack list to 240 devices based on country and software version. Those counts describe the stages in Dream’s reported search, not a confirmed total of vulnerable or compromised firewalls.
Compromise of a firewall can have consequences beyond the device itself. Dream says the attacker used the two affected firewalls at the government-affiliated organization to reach a server that manages other firewalls, then turned attention to Active Directory. That progression illustrates why incident responders need to assess connected management systems and accounts, rather than treating a compromised perimeter device as an isolated event. The report does not establish that the attacker achieved every objective or obtained particular information.
The timing also highlights a patching gap. PHP released corrected versions on Oct. 21, but Palo Alto’s advisory that day said fixed PAN-OS builds were still forthcoming. Dream says the relevant 12.1 and 12.2 branch fixes arrived between Oct. 27 and Oct. 29, after the reported attack. Palo Alto’s guidance during the interval was to keep the management interface off the internet. For organizations, restricting access to administrative pages can reduce exposure while vendor-specific updates are pending.
Products Worth Considering
Garmin Forerunner 55 GPS Running Smartwatch, Black
Oral-B iO Series 7 Rechargeable Electric Toothbrush with 2 Brush Heads and Charging Travel Case
BowFlex Results Series SelectTech Adjustable Dumbbells, Pair
As an affiliate, we earn on qualifying purchases.
Two Vulnerabilities, One Attack Chain
The name PHP2Shell refers to two PHP vulnerabilities described by Dream as allowing code execution through affected PAN-OS management services. The firewall software includes its own PHP runtime; Dream identifies it as PHP 8.0.30. The PHP project released updates to supported PHP branches on Oct. 21, but a PHP release alone did not update the separate PHP components bundled into PAN-OS. Palo Alto Networks published an advisory on the same date, with fixes for the affected firewall branches released later, according to the source account.
The second flaw in the reported chain, Fragnesia, is a Linux kernel vulnerability disclosed in May 2026 with a public exploit, according to Dream’s timeline and the cited security records. It could turn limited access into higher privileges on a vulnerable system. Dream says the attacker’s approach was not a single new vulnerability that immediately granted administrator control: it was a sequence using PHP2Shell for initial command execution and Fragnesia for privilege escalation.
Dream’s timeline says the attacker set up the security platform aiscan on Oct. 8 and later scanned and filtered potential targets. The company also reported finding Claude Code installed and DeepSeek and Kimi configured in aiscan. On Oct. 26, the U.S. Cybersecurity and Infrastructure Security Agency added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog and set a three-day remediation deadline for federal agencies, according to the source material.
“Dream said it had “no direct evidence” that AI tools wrote the exploit or scripts.”
— Dream
AI Use and Network Impact
The presence of AI-related tools does not establish that they generated the exploit, chose targets, or carried out the attacks. Dream explicitly said it had no direct evidence that AI wrote the exploit or scripts, and its account does not describe a fully autonomous operation. The extent to which the tools assisted the attacker, if at all, remains uncertain.
Other details also remain incomplete. The reported intrusion reached a government-affiliated network and included activity against Active Directory, but the source material does not specify whether data was exfiltrated, which accounts or systems were affected, or whether the attacker maintained access after discovery. It also does not provide a complete account of the 24 compromised firewalls’ owners or the status of every device at the time of publication. The figure of 19,000 refers to internet-facing management pages found in Dream’s search, not confirmed vulnerable systems.
Patch, Restrict, and Investigate
Organizations using affected PAN-OS branches should check Palo Alto Networks’ security advisory for the applicable fixed release and follow its mitigation instructions. Until systems are updated, the reported guidance is to keep the management interface inaccessible from the public internet. Administrators should also review access logs and investigate unexpected web shells, tunnels, firewall-management activity and changes to accounts or authentication controls.
For the affected government-affiliated organization, the next steps include determining how far the intrusion progressed, whether persistence remains, and what happened during the Active Directory activity. Dream’s published report and Palo Alto’s independent review provide an account of the attack chain, but a fuller public assessment of impact has not been supplied in the source material. Security teams should treat the incident as a prompt to verify patch status and review access to management services, not as proof that every exposed firewall was compromised.
Key Questions
What happened in the PHP2Shell attack?
Dream reported that an attacker chained two PHP2Shell flaws with the Linux kernel vulnerability Fragnesia to gain root access on 24 Palo Alto firewalls. The attacker later used compromised firewalls to enter a government-affiliated network and reach an internal firewall-management server.
Why did the attack happen after PHP released fixes?
The PHP project released corrected versions on Oct. 21, but the affected PAN-OS releases included their own PHP runtime. According to Dream, fixed builds for the relevant PAN-OS 12.1 and 12.2 branches arrived between Oct. 27 and Oct. 29. Palo Alto’s interim advice was to keep the management interface off the internet.
Did AI create or run the attack?
That has not been established. Dream found Claude Code installed and DeepSeek and Kimi configured in an offensive-security platform, but said it had no direct evidence that AI tools wrote the exploit or scripts. It also said the operation did not appear fully autonomous.
Were 19,000 firewalls compromised?
No. Dream said it found about 19,000 PAN-OS firewalls with internet-facing management pages, then narrowed its selection to 240 targets. It reported root access on 24 of those devices. The 19,000 figure is a count of exposed management pages in its search, not a count of confirmed compromises.
What should PAN-OS administrators do?
Check Palo Alto Networks’ advisory and install the fixed release that applies to the device. Until patched, restrict the management interface from public access. Administrators should also review logs and investigate signs of unauthorized access, web shells, tunnels, or account changes.
Source: ThorstenMeyerAI.com
