🔍 Read the full analysis: What “AI-Assisted” Really Means In A Two-Day PHP2Shell Attack on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream says an attacker used PHP2Shell and a previously disclosed Linux kernel flaw to gain root access on 24 Palo Alto Networks firewalls, then reached a 25th server on a US government-affiliated network. The company found AI tools on the attacker’s systems, but said it has no direct evidence they wrote the exploit or scripts or that the operation was fully autonomous.
Threat researchers at Dream say an attacker gained root access to 24 Palo Alto Networks PAN-OS firewalls in an automated operation on October 23, two days after PHP released fixes for the PHP2Shell flaws. The attacker then used compromised equipment to reach an internal server at a US government-affiliated organization, according to Dream’s October 26 report, updated October 29.
Dream’s account says the attacker selected 240 firewalls and attacked them in batches, compromising 24. The targets were in the United States, Japan, Taiwan and South Korea. Dream reported that 22 of the rooted firewalls were left with hidden web shells. The operation involved 25 servers in total: the 24 firewalls and an internal firewall-management server reached through the government-affiliated organization’s network.
The attacker chained PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 with Fragnesia, a Linux kernel privilege-escalation flaw identified as CVE-2026-46300 and disclosed in May, according to Dream. The PHP flaws provided a route to run code on the firewall’s management web server; Dream says Fragnesia then enabled the attacker to gain root privileges. Dream assessed that the chain, including installation of a persistent back door, could take less than 15 minutes.
Dream said the attacker’s infrastructure contained the coding assistant Claude Code and an offensive-security platform called aiscan configured with the AI models DeepSeek and Kimi. But the researchers said they had “no direct evidence” that AI tools wrote the exploit or scripts. Palo Alto Networks said its Unit 42 researchers independently verified the attacker’s tools and results. The available account does not establish that AI generated the attack code or operated the campaign autonomously.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Pages Enabled Access
The reported breach illustrates the risk of leaving firewall management interfaces reachable from the internet, particularly while a vendor fix is not yet available for the affected product branches. A firewall is meant to control network access; compromising its administrator account can give an attacker a foothold in a system that governs other security rules and devices.
Dream says the attacker used one compromised firewall to establish a route into the organization’s network, then took over the server used to manage its firewalls and targeted Active Directory, which controls user accounts and access to systems. The report does not say that the attacker successfully took over Active Directory. Even so, reaching that system could put an organization’s broader identity and access controls at risk.
The AI angle is less settled than the reported compromises. The presence of AI software on attacker infrastructure may indicate that tools were available to support the operation, but it is not evidence of what they did. For defenders, the directly supported lessons are more concrete: restrict management access, apply vendor fixes and address known privilege-escalation weaknesses.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Patch Timing and the Exploit Chain
The PHP project released updates on October 21, including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and urged users to update, according to the source account. Dream said PAN-OS used its own copy of PHP, version 8.0.30. Palo Alto Networks issued an advisory on October 21, but fixes for the affected 12.1 and 12.2 branches arrived between October 27 and October 29, according to the supplied material. That left a period between the advisory and fixed builds when exposure depended on network access and other mitigations.
Dream’s timeline says the attacker first identified about 19,000 firewalls with internet-facing management pages, then used a custom scanner to obtain version information from about 5,000. Filtering those results by country and software version narrowed the target list to 240. These are figures in Dream’s account; they describe its reconstruction of the attacker’s selection process, not a count of all vulnerable or compromised firewalls.
Fragnesia was not a newly disclosed weakness at the time of this operation. Dream says the Linux kernel flaw had been disclosed publicly in May with an exploit and had been fixed in the kernel. Its use alongside PHP2Shell meant the attacker combined a route into the management service with a separate flaw that could raise privileges. CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26 and gave federal agencies three days to act, according to the source material.
““no direct evidence””
— Dream
AI’s Role Remains Unverified
The reporting supports the presence of AI-related software on the attacker’s systems, but does not establish how it was used. Dream said it had no direct evidence that AI wrote the exploit or scripts, and assessed that the attack did not appear fully autonomous. The precise contribution of Claude Code, DeepSeek or Kimi, if any, remains unknown.
The supplied account also does not identify the government-affiliated organization or explain the full extent of the access gained after the attacker reached its internal firewall-management server. Dream reported that attacks on Active Directory followed, but did not confirm a successful takeover of that system. The number of organizations affected beyond the reported 24 firewalls and one internal server is not established here.
Dream’s findings are a company’s published investigation, with Palo Alto Networks’ Unit 42 reported to have independently verified the tools and results. The source material does not provide a public technical report from the affected organization or a complete incident assessment. Details about data access, any disruption and remediation remain unclear.
Apply Fixes and Restrict Access
Organizations using affected PAN-OS branches should consult Palo Alto Networks’ advisory and apply the fixed releases appropriate to their installations. Where updates cannot be applied immediately, the supplied material identifies keeping the management interface off the public internet as a protective measure. Security teams should also review firewall and identity-system activity for signs of unauthorized access, using their incident-response procedures.
Federal agencies were given three days after CISA’s October 26 catalog action to address the listed PHP2Shell vulnerabilities, according to the source account. Further reporting may clarify whether the government-affiliated organization suffered data loss or an Active Directory compromise, and whether investigators can establish a specific role for the AI tools found on the attacker’s systems. Until then, claims about AI authorship should remain qualified.
Key Questions
What happened in the PHP2Shell attack?
Dream reported that an attacker chained two PHP2Shell vulnerabilities with the Linux kernel flaw Fragnesia to gain root access on 24 PAN-OS firewalls. The attacker then reached an internal firewall-management server at a US government-affiliated organization, according to Dream.
Did AI write or run the attack?
That has not been established. Dream found Claude Code and an aiscan setup with DeepSeek and Kimi on attacker infrastructure, but said it had no direct evidence that AI wrote the exploit or scripts and that the operation did not appear fully autonomous.
How many systems were reportedly compromised?
Dream reported root access on 24 firewalls and a takeover of one internal firewall-management server, making 25 servers in total. The report says Active Directory was targeted, but does not confirm that it was taken over.
Why did the patch date matter?
PHP released fixes on October 21, and Palo Alto Networks issued an advisory that day. According to the supplied account, fixed PAN-OS builds for the affected 12.1 and 12.2 branches arrived between October 27 and 29, after the reported October 23-24 attack.
What should organizations do?
Apply the fixed PAN-OS releases specified in Palo Alto Networks’ advisory and restrict management pages from public internet access. Security teams should also review systems for signs of unauthorized access and follow incident-response guidance.
Source: ThorstenMeyerAI.com
