🔍 Read the full analysis: PHP2Shell Attack Analysis: Two Days From Patch To Root on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Dream says an attacker exploited two PHP flaws and a known Linux kernel vulnerability to gain root access on 24 Palo Alto Networks firewalls, then used a compromised firewall to reach a U.S. government-affiliated network. The attack began about two days after PHP released fixes, but fixes for the affected PAN-OS branches arrived later; Dream found AI tools on the attacker’s servers but says it has no direct evidence they wrote the exploit.
Dream’s account describes a chain involving CVE-2026-109618 and CVE-2026-109619, the two PHP2Shell vulnerabilities, and Fragnesia (CVE-2026-46300), a Linux kernel privilege-escalation flaw disclosed in May. Dream says PHP2Shell allowed commands to run on the firewall management web server as a low-privilege user. Fragnesia was then used to obtain root, the system’s highest level of access. Dream says the chain to a persistent back door took under 15 minutes.
On the evening of October 23, the attacker reportedly ran an automated batch against 240 selected firewalls, attacking five at a time. Dream says 24 were rooted; 22 were left with a hidden web shell. The reported targets were in the United States, Japan, Taiwan and South Korea. The attacker had first identified about 19,000 PAN-OS devices with management pages exposed to the internet, then narrowed the pool using version information and other filters, according to Dream.
Dream says two compromised firewalls belonged to a U.S. government-affiliated organization. On October 24, the attacker used a tunnel through one of them to compromise an internal server responsible for managing the organization’s firewalls, bringing the reported total to 25 affected servers. Dream says the attacker then targeted the organization’s Active Directory, which controls user identities and access. The source account does not establish what data, if any, was taken or whether the attempted activity succeeded.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Pages Enabled Access
The report shows how a public vulnerability disclosure can quickly become operational risk when affected products remain exposed and a working patch is not yet available. The PHP fixes were released on October 21, but Dream says Palo Alto’s affected PAN-OS branches did not receive fixed builds until October 27–29. The vendor’s October 21 advisory described fixes as upcoming. In the interim, Palo Alto advised keeping management interfaces off the public internet.
The reported move from firewall access to an internal management server matters because that server could provide a path deeper into an organization’s network. Dream also reports attacks on Active Directory, a system central to account access. The extent of any resulting access, data exposure or disruption is not established in the supplied account, so the case should not be read as evidence that those outcomes occurred.
Dream found Claude Code installed and DeepSeek and Kimi configured in an offensive-security platform called aiscan. That is evidence of AI tools present on the attacker’s infrastructure, not proof that AI generated the exploit or carried out the campaign autonomously. The immediate defensive issues identified in the report are more concrete: internet-accessible management pages, unpatched software and a known kernel flaw.
Products Worth Considering
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
Dell 24 Plus Monitor S2425HSM – 23.8 FHD (1920×1080) 144Hz 1ms, 2 x 3W Speakers, HDMI, Height/Tilt/Pivot/Swivel Adjustability, AMD FreeSync
Samsung Essential S3 27-Inch Curved FHD Monitor
As an affiliate, we earn on qualifying purchases.
From PHP Fixes to PAN-OS Patches
PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 and urged users to update, according to the source account. Palo Alto Networks issued an advisory that day for its products, which include their own PHP copy; Dream identifies the version in the affected PAN-OS environment as 8.0.30. Fixed builds for the attacked 12.1 and 12.2 branches followed between October 27 and 29.
The second vulnerability in the chain was not new: Fragnesia had been disclosed in May, with a public exploit, and had been fixed in the Linux kernel, according to the account’s cited timeline. Dream says the attacker configured aiscan with DeepSeek and Kimi on October 8, before the campaign. Dream’s researchers found the attack artifacts on October 25 and published their report on October 26, updating it on October 29.
On October 26, the U.S. Cybersecurity and Infrastructure Security Agency added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog and set a three-day deadline for federal agencies, according to the supplied material. That catalog action reflects reported exploitation; it does not by itself establish the full impact of this particular campaign.
““No direct evidence” shows that AI tools wrote the exploit or scripts.”
— Dream
AI Role and Network Impact Remain Unknown
Dream says it has no direct evidence that AI wrote the exploit or scripts. The discovery of Claude Code, DeepSeek and Kimi on attacker-controlled systems does not show whether they were used in this campaign, or what tasks they may have supported. The phrase “AI-built exploit chain” should therefore be treated as a description circulating around the report, not a confirmed finding.
The supplied account also leaves open what information the attacker accessed, whether any data was removed, and whether Active Directory was successfully compromised or only targeted. It does not identify the affected organizations beyond describing one as government-affiliated, nor does it provide a complete account of remediation or the status of all 24 firewalls. Palo Alto’s verification is reported, but its detailed findings are not included here.
Patch Builds and Incident Findings
Organizations using the affected PAN-OS branches should check Palo Alto Networks’ current security advisory and apply the fixed builds relevant to their installations. The immediate exposure-reduction measure identified in the advisory is to keep firewall management interfaces off the public internet. Administrators should also review systems for signs of compromise and assess access from firewall management infrastructure into internal identity and control systems.
Federal agencies were given three days by CISA after the vulnerabilities were added to the Known Exploited Vulnerabilities catalog on October 26. Further reporting from Dream, Palo Alto Networks or affected organizations may clarify the scope of the intrusion, the evidence behind the verification, and whether the attacker’s AI tools played any operational role. Those details are not established in the supplied material.
Key Questions
What were the PHP2Shell vulnerabilities?
They are CVE-2026-109618 and CVE-2026-109619, two critical PHP flaws for which PHP released fixes on October 21, 2026. Dream says the attacker used them to run commands on exposed firewall management web servers.
How did the attacker obtain root access?
According to Dream, the attacker chained PHP2Shell with Fragnesia (CVE-2026-46300), a Linux kernel privilege-escalation flaw disclosed in May. Dream says the PHP flaws provided initial command execution and Fragnesia elevated access to root.
How many systems were reportedly compromised?
Dream reports root access on 24 firewalls and a further internal firewall-management server reached through a compromised firewall, for a reported total of 25 servers. The source account does not provide a complete remediation status.
Did AI create or run the attack?
That has not been established. Dream found AI-related tools and configured models on the attacker’s servers, but said it had no direct evidence they wrote the exploit or scripts and that the operation did not appear fully autonomous.
What should PAN-OS administrators do?
Check Palo Alto Networks’ advisory for the applicable fixed build and install it. The supplied account also says the vendor advised keeping management pages off the public internet; administrators should review systems for signs of compromise.
Source: ThorstenMeyerAI.com
