A Custom PHP2Shell Build Rooted 25 PAN-OS Firewalls, Three Tied to a US Government Environment, Dream Says

An unauthenticated attacker who can reach a PAN-OS management web interface from the internet can run code as nobody and then become root, according to Dream Research. Dream said it found artifacts of a campaign that rooted 25 Palo Alto Networks firewalls and management servers between October 23 and October 24, 2026, three of them in a US government-affiliated environment.

Palo Alto Networks' Unit 42 updated its own PHP2Shell page on October 29 to say it had independently verified the same attacker's tooling and confirmed Dream's results. The company's page says customers who have applied the available PAN-OS patches are not affected, because the fixes interrupt the observed chain.

How the chain works

The first stage is PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the PHP session upload-progress flaw covered in The Terminal's earlier reporting on CISA's three-day deadline. Dream's writeup says this build targets appweb, the PAN-OS management web server, and gives code execution as the nobody user without credentials. Dream calls it a "custom, non-public build, not a copy of any known public exploit for PHP2Shell."

The second stage is CVE-2026-46300, which Dream calls Fragnesia: a Linux XFRM ESP-in-TCP kernel flaw. The attacker used it to overwrite /etc/pam.d/su, so that su root succeeds without a password. Both stages run in one HTTP request, in under 15 minutes.

The exploit carries one profile per PAN-OS build. The attacker's final target filter used only the 12.1 and 12.2 branches (PHP 8.0.30), not 11.1.

From 19,000 firewalls to 25 rooted

Dream reconstructed a targeting funnel from the attacker's artifacts. The attacker used FOFA, an internet-scanning search engine, to find about 19,000 internet-facing PAN-OS firewalls. About 5,000 answered a version scan, and 240 survived a filter on country (the US, Japan, Taiwan and South Korea) and matching versions.

1. Found via FOFA19K firewalls
2. Answered version scan5000 firewalls
3. Matched country and version240 firewalls
4. Rooted in automated batch24 firewalls

Source: Dream Research, Oct. 26 2026 (updated Oct. 29), accessed 2026-10-29

The automated batch rooted 24. Twenty-two were left "owned and parked" with webshells and no further activity, per Dream. Two were government-affiliated firewalls, and a third compromise, an internal firewall management server reached through a tunnel, brought the total to 25.

Timeline in the government environment

Date (UTC)	Event
Oct. 8	Operation setup begins
Oct. 23, 18:14	First government-affiliated firewall rooted; it crashed and never recovered
Oct. 24, 10:09	Second government-affiliated firewall exploited
Oct. 24, 11:35	Internal management server exploited, total reaches 25
Oct. 25	Dream researchers uncover the artifacts

From the management server, Dream says the attacker decrypted the LDAP service account password and attempted a password spray against a domain with no lockout threshold. It also tried to create backdoor accounts and extract a SAML signing key. Whether any of that succeeded is unknown, because the results were not recovered.

Attribution is not settled

Dream does not name an actor. It says Unit 42 tracks the activity as CL-UNK-1280 and links it to a Chinese-speaking operator working in the UTC+8 time zone. The Unit 42 PHP2Shell page does not use that designation in the version retrieved on October 29, so that link rests on Dream alone.

Dream cites FOFA, the iox tunnelling tool, DeepSeek and Kimi models inside an "aiscan" platform, and Chinese-language prompts in session logs. It found no direct evidence that AI wrote the exploit or its scripts.

Unit 42 has already walked back one PHP2Shell attribution: on October 25 it retracted an October 23 update tying a European government agency's compromise to the flaw.

What to do

Unit 42 says customers "should immediately remove public internet access to management interfaces if it is enabled" and restrict management access to trusted internal addresses. It says about 0.02% of Palo Alto Networks' global installed base has an internet-facing management interface and was impacted, and that those customers were contacted individually. The page does not list affected versions. A separate PHP flaw, CVE-2026-115560, is not fixed by the PHP2Shell releases, so a PHP upgrade alone does not close every path.

Dream's recovered artifacts show 22 parked firewalls still reachable and private keys taken from firewall filesystems. Operators who exposed a management interface should look for webshells and for a modified /etc/pam.d/su, which is the change the chain makes.