🔍 Read the full analysis: The Meaning Of “AI-Assisted” In A PHP2Shell Server Takeover on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dream reported that an attacker used PHP2Shell vulnerabilities and a Linux kernel flaw to gain root access to 24 Palo Alto Networks firewalls, then compromised an internal management server. Dream found AI tools in the attacker’s environment but said it has no direct evidence they wrote the exploit or attack scripts. The incident highlights the risk of internet-exposed firewall management pages and the gap between an advisory and available fixes.
Security firm Dream says an attacker used two newly patched PHP flaws and a previously disclosed Linux kernel vulnerability to gain root access to 24 Palo Alto Networks firewalls on October 23, then used compromised equipment to reach a U.S. government-affiliated organization’s internal network the next day. Dream found AI tools on servers linked to the attacker, but said it has no direct evidence that those tools created the exploit or scripts, leaving “AI-assisted” as a qualified description rather than a proven explanation.
In a report published October 26 and updated October 29, Dream described an automated attack on 240 firewalls that it says were selected from a larger pool of internet-accessible management pages. The attacker reportedly gained root access on 24 devices. Dream says the targets were in the United States, Japan, Taiwan and South Korea. Palo Alto Networks said its Unit 42 researchers independently verified the attacker’s tools and results.
Dream says the attacker chained PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 with Fragnesia, a Linux kernel privilege-escalation flaw tracked as CVE-2026-46300 and made public in May. The PHP flaws reportedly enabled command execution under a restricted account; the kernel flaw then enabled elevation to root. Dream said the attack chain, including installation of a persistent back door, took less than 15 minutes. These technical details are findings attributed to Dream, not a separate reconstruction in the source material.
According to Dream, 22 of the rooted firewalls were left with hidden web shells. Two compromised firewalls belonged to a U.S. government-affiliated organization. The attacker then used a tunnel through one of them to access an internal server used to manage the organization’s firewalls, bringing the reported total to 25 compromised servers. Dream says activity against the organization’s Active Directory followed. The supplied account does not establish the extent of any resulting access to user accounts or data.
Infographic 01 · PHP2Shell on Palo Alto firewalls
Two days from patch to root.
PHP fixed the bug on 21 October. Fixed firewall software for the attacked branches arrived almost a week later. The attack ran in between.
- 13–23 MayFragnesia goes public, kernel fix followsLinux privilege-escalation bug with a public exploit; CVE-2026-46300.
- 8 OctAttacker sets up an AI platformaiscan configured with DeepSeek and Kimi, per Dream’s timeline.
- 21 OctPHP fixes PHP2ShellPHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Palo Alto advisory the same day; PAN-OS fixes “upcoming”.
- 23 Oct, evening UTCBatch run: 240 targets, 24 rootedFound via device search engine, filtered to US, Japan, Taiwan, South Korea.
- 24 OctInto a government-affiliated networkTunnel, persistence, internal management server rooted (no. 25), Active Directory attacked.
- 26 OctDream publishes · CISA lists PHP2ShellFederal deadline 29 Oct.
- 27–29 OctFixed PAN-OS builds for 12.2 and 12.1CISA lists Fragnesia on 28 Oct; Unit 42 confirms Dream’s results on 29 Oct.
The fix for PHP existed. The fix for the firewall did not, yet. The open management page was the only door that mattered.Thorsten Meyer · my reading
Sources: Dream Research, 26 Oct 2026 (updated 29 Oct); php.net, 21 Oct 2026; Palo Alto Networks advisory (updated 29 Oct 2026); CISA KEV catalog, version 29 Oct 2026; oss-security, 13 May 2026; Unit 42, 29 Oct 2026. Day count: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exposed Management Pages Enabled Access
The reported path from an exposed management page to an internal server shows how a device meant to enforce network boundaries can become an entry point when its administrative interface is reachable from the internet and vulnerable software remains in use. The risk is not limited to the initial firewall: a foothold on a device with access to internal systems may give an attacker a route toward infrastructure used to control other devices.
The report also shows why the timing of fixes matters. Palo Alto Networks published an advisory on October 21, according to the source, while fixed builds for the affected PAN-OS 12.1 and 12.2 branches were released between October 27 and 29. That left a period in which organizations needed to rely on measures such as restricting management access, rather than installing a fixed build for those branches. The account does not say how many exposed systems were vulnerable overall or how many organizations were affected.
For readers assessing the “AI” element, the distinction is material: finding AI software in an attacker’s environment is not proof it generated the code or carried out the intrusion. The reported compromise depended on known vulnerabilities, exposed administration and an attack chain. Whether AI sped up any part of the work remains unverified.
Products Worth Considering
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
LG UltraGear 45GX900A-B 45-Inch Curved OLED Gaming Monitor
LG 24G414B-B 24-Inch UltraGear Full HD IPS Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Patches Followed the Attack Window
Dream’s timeline says the Fragnesia kernel vulnerability was disclosed in May 2026 with a public exploit and a kernel fix. On October 21, the PHP project released security updates for several PHP branches, and Palo Alto Networks issued an advisory for the firewall vulnerabilities. The source says PAN-OS includes its own PHP copy, listed by Dream as version 8.0.30, so updating a separate PHP installation would not by itself address the firewall software.
Dream says it identified about 19,000 PAN-OS firewalls with internet-facing management pages before the attack, obtained version information from about 5,000, and narrowed its candidate list to 240 based on country and version. These figures describe the report’s scanning and selection process; they are not counts of confirmed vulnerable or compromised devices. CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26 and gave federal agencies three days to act, according to the supplied source.
The attacker’s reported use of AI tools is based on artifacts Dream says it found: Claude Code was installed, and DeepSeek and Kimi were configured in an offensive-security platform called aiscan. The presence of those tools is evidence about the attacker’s environment, but not about how specific exploit code was produced or whether the tools were used during the attack.
““no direct evidence” that AI tools wrote the exploit or scripts”
— Dream
AI’s Role Remains Unverified
Dream has not established whether Claude Code, DeepSeek or Kimi contributed to writing, testing or adapting the exploit, or whether they were used at all during the intrusion. Finding the software configured on attacker infrastructure does not identify what it did. The source also does not provide independent confirmation of every part of Dream’s timeline, the full scope of the government-affiliated organization’s exposure, or whether data was accessed or removed.
The number of affected firewalls beyond the 24 reported compromises is also unknown. The reported 19,000 devices with exposed management pages and 240 selected targets are scanning figures, not confirmed counts of vulnerable systems. The supplied material does not establish whether additional compromises have been identified since Dream’s report or whether all affected systems have been remediated.
Fixes and Exposure Checks Continue
Organizations using the affected PAN-OS branches should check Palo Alto Networks’ current security advisory for applicable fixed releases and follow the vendor’s remediation guidance. The source says fixed builds for the attacked 12.1 and 12.2 branches shipped between October 27 and 29. Where an update cannot yet be applied, restricting management interfaces from public internet access is the protection identified in the source; administrators should also review systems for signs of compromise rather than assume patching alone removes an existing foothold.
Federal agencies were given three days after CISA added the PHP2Shell vulnerabilities to its exploited-vulnerabilities catalog on October 26, according to the report. Further clarity depends on additional incident findings from Dream, Palo Alto Networks, affected organizations or government agencies. Until those are available, the attacker’s use of AI remains unconfirmed, as do the full scope of the intrusion and any resulting data impact.
Key Questions
What happened in the PHP2Shell attack?
Dream says an attacker chained the PHP2Shell flaws with a Linux kernel vulnerability to gain root access to 24 firewalls and then reach an internal firewall-management server. The reported attacks occurred on October 23 and 24, 2026.
Does the report prove AI wrote the exploit?
No. Dream found Claude Code installed and DeepSeek and Kimi configured on attacker-linked systems, but said it had no direct evidence that AI tools wrote the exploit or scripts. Their role in the attack remains unclear.
How many servers did Dream say were compromised?
Dream reported root access on 24 firewalls and access to one internal firewall-management server, for 25 servers in total. Those are the firm’s reported findings; the material does not establish the total number of affected systems beyond those cases.
What should organizations check?
Organizations should consult Palo Alto Networks’ advisory for affected PAN-OS versions and fixed releases, restrict management pages from public access, and investigate for signs of compromise. The source specifically identifies keeping the management interface off the internet as a protection while fixes were pending.
Source: ThorstenMeyerAI.com
