The 25-Server Firewall Campaign

Dream Research reports that one attacker chained a custom PHP2Shell exploit with the Linux kernel flaw Fragnesia to root 25 Palo Alto Networks PAN-OS servers across the US, Japan, Taiwan and South Korea by 24 October 2026.⁠¹ Palo Alto's Unit 42 says it independently verified the attacker's tooling, and that patched builds interrupt the observed chain.⁠² If you run an affected PAN-OS build, restrict management access to trusted systems, apply the appropriate vendor hotfix, and investigate possible compromise if the interface was exposed.

The vulnerable component is the PAN-OS management web interface, meaning the HTTPS web UI and the XML API service. Palo Alto says the GlobalProtect portal, gateway and Clientless VPN are not impacted, and a dataplane interface is affected only if a management profile is attached to it.⁠³ Dream's report says the exploited management web server also fronts the GlobalProtect portal. Palo Alto's advisory still lists GlobalProtect as unaffected.⁠¹⁠³

PHP fixed the two underlying flaws, CVE-2026-109618 and CVE-2026-109619, on 21 October.⁠⁴ The complete PHP2Shell guide covers them in full. This article covers only the reported firewall campaign and what the record supports.

Dream names PAN-OS, and the vendor confirms the tooling

Reported Dream published its report on 26 October and updated it on 29 October. It says it found artifacts on 25 October of a campaign that rooted 25 PAN-OS firewall and management servers in four countries, including three servers in a US government-affiliated environment.⁠¹ The 29 October update names Palo Alto Networks as the vendor and says Unit 42 verified the attacker's tooling and results.⁠¹

Palo Alto's advisory, published 21 October and updated 29 October, rates the PHP flaws critical, marks exploit maturity as attacked, and reports active exploitation against internet-exposed management interfaces.⁠³ Unit 42 says about 0.02% of its installed base had internet-facing management interfaces and was affected, and that it contacted each customer.⁠²

The chain, as reported, ran from one request to root

Reported Dream says the attacker used a custom, non-public PHP2Shell build aimed at PHP's session upload-progress mechanism on the PAN-OS management web server, which runs PHP 8.0.30 with a high memory limit. It paired that with Fragnesia to go from the web server's low-privilege account to root, in one request and under 15 minutes.⁠¹ Fragnesia is a Linux kernel local privilege escalation flaw rated CVSS 3.1 7.8 in the CVE record.⁠⁷

Dream describes a funnel. FOFA, a Chinese internet asset search engine, listed about 19,000 internet-facing PAN-OS firewalls. About 5,000 answered a version scanner. Country and version filters left 240 targets, and an automated batch rooted 24.⁠¹ A third server, the internal management server, brought the total to 25.⁠¹

The exploit needed version-specific tuning, so the attacker filtered by version first.⁠¹

PHP 8.0.30 is outside upstream support, because the PHP project no longer updates 8.1 and older.⁠⁴ PHP versions that no longer get official fixes explains what that means for operators. On an appliance, the fix runs through vendor firmware.

Dream reports that attackers planted web shells on 22 of the firewalls without further observed post-exploitation activity. On the government-affiliated target it describes a reboot-surviving reverse SSH tunnel, then Active Directory activity from the management server. Dream confirms LDAP service account password decryption and user and group enumeration. It cannot say whether password spraying, backdoor accounts or SAML key extraction succeeded.⁠¹

Dream also lists Claude Code, an offensive platform called aiscan configured with DeepSeek and Kimi, and FOFA API keys on the attacker's infrastructure. It says it has no direct evidence AI wrote the exploit or scripts, and that the operation does not look fully autonomous.⁠¹

Attribution is Dream's assessment, and no actor is named

Dream names no actor. It lists the indicators behind its suspected China-nexus assessment: the four target countries, FOFA, a Chinese-developed tunneling tool, the two Chinese language models, UTC+8 timestamps and Chinese-language prompts in session logs.⁠¹ Dream adds that Unit 42 tracks the activity as CL-UNK-1280 and attributes it to a Chinese-speaking attacker in UTC+8. The Unit 42 brief I opened does not use that name.⁠¹⁠²

Opinion Several of these indicators are weak evidence one at a time. Using a Chinese-developed service or tool does not by itself identify who used it. The assessment is Dream's, and no threat actor has been established.

The earlier Unit 42 claim was withdrawn, and is a different story

Unit 42's 23 October update tied post-compromise activity at a European government agency to PHP2Shell. On 25 October it retracted that update. It said the activity ran in the context of a vulnerable PHP application, and it could not confirm initial access through the CVEs.⁠² The 29 October verification concerns Dream's attacker. It does not revive the retracted claim.

What the record still lacks

The government affiliation is Dream's reading of configuration characteristics such as smart-card authentication and asset naming. No agency has confirmed it. CISA and the FBI declined to comment to The Register.⁠¹⁠⁸

Both main accounts carry commercial interest. Dream sells defense platforms and says its own research product ran the investigation. Palo Alto sells the affected product and is the party verifying.⁠¹⁠² Opinion Treat the details as reported by interested parties until a customer or agency confirms them.

The public record does not establish whether the 22 additional firewalls have since been remediated, or whether the tunnel into the government-affiliated network is still open. Dream's statements about persistence describe recovered artifacts, not the current state of any system.⁠¹ In the pages I opened, neither Dream nor Unit 42 publishes attacker IP addresses or domains. The password spray outcome is unknown.

How you'd notice

Dream reports a 103-byte PHP web shell at /unauth/php/change_password.php on compromised devices. It also reports a tunnel launched from /usr/local/lib/.panops/ through a systemd service and an rc.local entry.⁠¹ Check for both. Look for outbound SSH sessions from management addresses that nobody opened.

On the directory side, look for the firewall's LDAP service account used from unexpected sources, failed logons spread across many accounts, and new user or machine accounts. Signs of compromise on a server covers host-level checks. How to hunt for PHP2Shell exploitation covers the PHP side.

Restrict management access, patch, then investigate

Palo Alto's advisory lists fixed hotfixes for each maintenance line. These are examples for the newest line in each branch, not the only fixed builds. Match your exact maintenance release to the vendor's full matrix.⁠³

The advisory's timeline shows fixed builds for each supported branch released between 25 and 29 October.⁠³

Do today

1. Restrict every firewall management interface to trusted internal addresses or a jump box, and remove internet access to it, as Palo Alto advises.⁠²⁠³
2. Check your exact PAN-OS maintenance release against the full matrix and upgrade to the fixed build for your line.
3. Read the advisory of any other vendor whose management interface is reachable from untrusted networks.

Do this week

4. Hunt the management plane for the web shell path, the tunnel directory and unexplained outbound SSH on any device that ran an affected build between 23 and 29 October.
5. Review directory logs for the indicators above before changing anything. If you find or suspect compromise, rotate the LDAP service account and the relevant keys and certificates under your incident-response process. Dream says it recovered evidence that the attacker harvested private keys from the firewall filesystem.⁠¹
6. Install your distribution's kernel update for CVE-2026-46300 on Linux systems you control. CISA's KEV entry carries a 31 October federal due date.⁠⁷ Patching PHP on Linux servers covers the PHP half.
7. Leave generic PHP packages off sealed appliances. Vendor firmware is the fix.

Can wait

8. Set an account lockout threshold in Active Directory. Dream says the affected domain had none, which allowed unlimited password spraying.⁠¹
9. Re-read Dream's report and Palo Alto's advisory, both last updated 29 October, for added victims, indicators or a named actor.