TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Dream Security reports that attackers used a custom PHP2Shell exploit chain and a Linux kernel privilege-escalation flaw to gain root access on 25 PAN-OS firewall and management servers in four countries. Recovered artifacts show credential extraction and Active Directory enumeration after the compromises; Palo Alto Networks has independently verified the attacker tooling and says it is releasing fixes.
Dream Security says attackers rooted 25 Palo Alto Networks PAN-OS firewall and management servers across the United States, Japan, Taiwan and South Korea after chaining a custom PHP2Shell exploit with a Linux kernel privilege-escalation flaw. The recovered artifacts include activity targeting three servers in a US government-affiliated environment and show attackers extracting credentials and enumerating Active Directory after gaining access.
Dream said its researchers found the operation on October 25, including a custom exploit chain, target lists, exploitation logs and about 40 post-exploitation scripts. The chain combined PHP2Shell vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619 with Fragnesia, a kernel privilege-escalation flaw identified as CVE-2026-46300. According to Dream, the attacker could use the vulnerabilities together in one HTTP request to gain root access on vulnerable, internet-facing systems without credentials.
The exposed surface was the PAN-OS management web server, which also fronts the GlobalProtect portal. Dream said the recovered PHP2Shell implementation was a custom, non-public build tailored to PAN-OS. The researchers reported that the exploit first obtained code execution in a restricted web-server process and then used the kernel flaw to escalate privileges. This account describes Dream’s analysis; the detailed exploit mechanics have not been independently set out in the supplied Palo Alto Networks statement.
After compromising the firewalls, the attacker moved toward organizational identity systems. Dream said artifacts confirm credential extraction and Active Directory enumeration, and that the activity reached three servers in a US government-affiliated environment. Palo Alto Networks’ Unit 42 independently verified the attacker’s tooling and results, Dream reported. Palo Alto Networks is releasing fixed PAN-OS versions across affected branches, though the supplied material does not list the versions or release schedule.
From Firewall Access to Directory Data
The reported activity matters because a firewall management system can sit at a sensitive boundary between the public internet and an organization’s internal network. If attackers gain root-level access to a firewall, the consequences may extend beyond the device itself, particularly when operators can use that foothold to pursue credentials and directory information. Dream’s artifacts indicate that this campaign did move toward Active Directory infrastructure.
The presence of government-affiliated systems among the targets raises the stakes for affected organizations, but the report does not establish that government operations or data were disrupted. The confirmed significance is narrower: Dream found evidence of successful compromise and post-exploitation activity, including credential-related actions. That makes assessment of internal access and possible credential exposure relevant alongside installing vendor fixes.
The incident also illustrates the risk of exposed management interfaces running vulnerable software. A patch can address the entry point, but it cannot by itself establish whether an attacker already gained access or whether credentials and other internal systems were affected. Organizations using the impacted PAN-OS builds may need to determine both device exposure and the scope of any prior activity.
Products Worth Considering
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
Dyson V8 Cordless Vacuum
Levoit Vital 100S-P Air Purifier for Home and Pets
As an affiliate, we earn on qualifying purchases.
How the Exploit Chain Worked
Dream describes the attack as two linked stages: PHP2Shell provided remote code execution through the PAN-OS management web server, while Fragnesia provided a route from restricted process access to root. The company says the PHP vulnerability involved PHP’s session upload-progress feature and that the second flaw affected a Linux kernel subsystem. The two-stage design allowed the attacker to move from an initial foothold to administrator-level control, according to the research.
Dream also reported signs of possible AI-assisted development. Its researchers found Claude Code installed, an offensive-security platform called aiscan configured with DeepSeek and Kimi models, and API keys for the Chinese reconnaissance platform FOFA. However, Dream said it had no direct evidence those AI tools wrote the exploit or the post-exploitation scripts. It said the scripts’ structure and comments suggested AI assistance, while cautioning that the operation did not appear to be a fully autonomous nation-state attack.
Dream said it is sharing updates and collaborating on the investigation with Palo Alto Networks, whose Unit 42 verified the attacker tooling and results. The report was updated October 29, 2026, to add information from that collaboration. This places the disclosure in an ongoing vendor investigation rather than a final public accounting of every affected system.
““We have no direct evidence that the AI tools were specifically used to write the exploit or the post-exploitation scripts.””
— Dream Security
Scope and Attribution Remain Open
The supplied report does not identify the affected PAN-OS versions, name the 25 servers, or provide a complete account of how many organizations were involved. It says three servers in a US government-affiliated environment were targeted, but does not specify the agency or describe any confirmed operational disruption. The exact amount or type of information accessed is also not stated beyond credential extraction and directory enumeration.
Dream reported evidence consistent with AI-assisted development, but it did not establish that AI systems generated the exploit code. The material also does not establish who operated the campaign or attribute it to a government. The use of Chinese-language models and the presence of reconnaissance-platform credentials are not, on their own, proof of an operator’s nationality or sponsorship.
The supplied information does not give the fixed software versions, a patch timeline, or technical indicators that defenders can use to assess their systems. Palo Alto Networks’ separate update may provide additional details, but those specifics are not included in the source material provided here.
Patches and Incident Reviews Ahead
Palo Alto Networks is releasing fixed PAN-OS versions across affected branches, according to Dream. Organizations should consult the vendor’s current advisory for the impacted releases and applicable fixes, then determine whether their devices were exposed and whether they show signs of compromise. The source material does not specify a date by which every branch will receive a fix.
For systems that may have been reached, remediation also involves investigating activity beyond the firewall. Dream’s account points to credential extraction and Active Directory enumeration, so organizations will need to assess relevant logs and internal access, and consider whether exposed credentials require action. The precise response steps and indicators are not detailed in the supplied report.
Dream and Palo Alto Networks are continuing to collaborate on the investigation. Further vendor guidance and a clearer accounting of affected versions, systems and observed consequences remain the key developments to watch.
Key Questions
How many PAN-OS servers were rooted?
Dream Security reports that attackers rooted 25 firewall and management servers across the United States, Japan, Taiwan and South Korea. The company’s supplied report does not name the servers or organizations.
What did the attackers use to gain root access?
Dream says the attackers chained custom PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with the Fragnesia kernel privilege-escalation flaw, CVE-2026-46300. It reports that the chain could reach root on vulnerable internet-facing systems without credentials.
Were US government systems affected?
Dream says the artifacts included activity against three servers in a US government-affiliated environment. The report does not identify the agency or say whether government operations were disrupted.
Did AI write the exploit?
That has not been established. Dream found AI-related tools in the attacker infrastructure and said the scripts’ style suggested possible AI assistance, but it reported no direct evidence that AI tools wrote the exploit or scripts.
What should organizations do now?
Organizations should check Palo Alto Networks’ current advisory for the affected PAN-OS branches and fixed releases, then assess exposure and investigate possible prior access. Dream’s report says the campaign included credential extraction and Active Directory enumeration, so review should not stop at applying a patch.
Source: dreamgroup.com
