🔍 Read the full analysis: What The Palo Alto PHP2Shell Incident Teaches About AI-Assisted Attacks on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream says an attacker exploited PHP2Shell and a known Linux kernel flaw to gain root access to 24 Palo Alto Networks firewalls, then reached a government-affiliated organization’s internal network. AI tools were present on the attacker’s servers, but Dream said it has no direct evidence they wrote the exploit or scripts. The incident highlights exposed management interfaces, delayed fixes for affected PAN-OS branches and the speed of chaining known vulnerabilities.
Researchers at Israeli security company Dream say an attacker gained root access to 24 Palo Alto Networks firewalls in an automated campaign on October 23, then used compromised equipment to enter a U.S. government-affiliated network the following day. The attack chained two recently disclosed PHP flaws, known as PHP2Shell, with a previously public Linux kernel vulnerability; although AI tools were found on the attacker’s servers, Dream said it has no direct evidence that AI created the exploit or attack scripts.
Dream’s account, published October 26 and updated October 29, says the attacker scanned internet-facing PAN-OS management pages, narrowed a much larger pool of devices to 240 targets and attacked them in automated batches. The campaign rooted 24 firewalls across the United States, Japan, Taiwan and South Korea. Dream says 22 were left with a hidden web shell, while two belonged to the government-affiliated organization. The attacker used those devices to reach an internal firewall-management server, bringing the reported total to 25 compromised servers.
The exploit chain combined PHP2Shell, CVE-2026-109618 and CVE-2026-109619, with Fragnesia, a Linux kernel privilege-escalation flaw disclosed in May as CVE-2026-46300. Dream says PHP2Shell first allowed commands to run under a restricted account on the firewall; Fragnesia then enabled the attacker to gain root access. The company says the chain, including installation of persistent access, could be completed in under 15 minutes. Palo Alto Networks said its Unit 42 researchers independently verified the attacker’s tools and results.
Dream also reported finding the coding assistant Claude Code installed on attacker infrastructure, with DeepSeek and Kimi models configured in an offensive-security platform called aiscan. Those artifacts support the possibility that AI tools were part of the attacker’s workflow, but they do not establish how the tools were used. Dream said the attack did not appear fully autonomous and that it had no direct evidence AI wrote the exploit or scripts.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Known flaws, exposed management pages
The incident illustrates how an attacker can turn known vulnerabilities into a rapid compromise when a device’s administrative interface is exposed to the internet. The PHP fixes were available upstream on October 21, but Palo Alto’s fixes for the affected PAN-OS 12.1 and 12.2 branches shipped between October 27 and 29, according to the source account. That left a period when affected firewall administrators needed to limit access to management pages while vendor updates were pending.
The government-network intrusion also shows why a firewall breach can matter beyond the appliance itself. Dream says the attacker used compromised firewalls as a route to an internal management server and then targeted Active Directory, which governs access to accounts and systems. The source does not report the final outcome of those attempts. The AI angle is relevant, but the confirmed account points to familiar weaknesses—exposed administration, an unpatched kernel flaw and a chain of known bugs—rather than proof of an autonomous AI-led operation.
Popular right now
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Breville Bambino Espresso Machine, Brushed Stainless Steel (BES450BSS)
Samsung 85-Inch QN70H Neo QLED 4K Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
From disclosure to compromise
Fragnesia was publicly disclosed in May 2026 and had a kernel fix and public exploit, according to the source material. Dream’s timeline says the attacker set up aiscan with DeepSeek and Kimi on October 8. On October 21, PHP issued updated releases addressing PHP2Shell, while Palo Alto published a security advisory and said fixed PAN-OS builds were forthcoming.
Before the October 23 campaign, Dream says it identified about 19,000 PAN-OS firewalls with internet-facing management pages through FOFA, a search engine for internet-connected devices. A custom scanner obtained version information from about 5,000, and filtering by country and software version produced the 240 targets attacked. Dream says the first government-affiliated firewall was compromised on October 23; the attacker returned the next morning, reached an internal management server and then targeted Active Directory. CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26 and gave federal agencies three days to act, according to the supplied account.
““no direct evidence” that AI tools wrote the exploit or scripts”
— Dream
AI’s role remains unproven
The available account does not establish whether AI generated any code, selected targets, adapted the exploit chain or helped operate the campaign. Finding Claude Code and configured DeepSeek and Kimi models shows access to those tools, not how they were used. Dream’s characterization is that the operation did not appear fully autonomous.
Other details also remain incomplete in the supplied reporting. It does not say whether the attacker’s Active Directory efforts succeeded, what data or systems may have been accessed, or whether every compromised device was cleaned up. The account identifies a government-affiliated organization but does not name it. Palo Alto’s independent verification, as described in the source, concerns the tools and results; it does not resolve these unanswered questions.
Patch, restrict, investigate
Organizations using affected PAN-OS releases should apply the vendor’s fixed builds and restrict firewall management interfaces to trusted networks or authorized access paths. The source account says fixes for affected 12.1 and 12.2 branches shipped between October 27 and 29. Security teams should also check for signs of persistence and investigate access to connected management systems and identity infrastructure; the report’s findings make a firewall-only review insufficient for determining the scope of an intrusion.
Further clarity depends on updates from Palo Alto Networks, Dream and the affected organization. Publicly available information in the supplied account does not establish the full impact of the Active Directory targeting or the attacker’s use of AI tools. Those findings will determine whether the incident is best understood as conventional vulnerability chaining with AI assistance, or whether AI played a more substantial role.
Key Questions
What was PHP2Shell?
PHP2Shell refers to two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Dream says they allowed an attacker to run commands on affected PAN-OS firewalls, initially as a restricted user.
How did the attacker gain root access?
According to Dream, the attacker chained PHP2Shell with Fragnesia, a Linux kernel privilege-escalation flaw disclosed in May. The combination turned initial command execution into root access.
Did AI create the attack?
That has not been established. Dream found AI-related tools and configured models on attacker infrastructure, but said it had no direct evidence they wrote the exploit or scripts.
How many systems were reported compromised?
Dream reported root access on 24 PAN-OS firewalls and a later compromise of one internal firewall-management server, for 25 servers in total.
What should PAN-OS administrators do?
Install the fixed releases for affected branches and keep management interfaces off the public internet or restricted to trusted access. Organizations should also investigate connected systems for possible persistence or follow-on access.
Source: ThorstenMeyerAI.com
