TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Dream Security says attackers chained a custom PHP2Shell exploit with a Linux kernel privilege-escalation flaw to gain root access on 25 exposed PAN-OS servers. Recovered artifacts indicate credential extraction and directory enumeration after the compromise, including activity targeting three servers in a US government-affiliated environment. Palo Alto Networks’ Unit 42 independently verified the tooling and results, according to Dream; the full scope and attribution remain unclear.
Dream Security says attackers rooted 25 Palo Alto Networks PAN-OS firewall and management servers across the United States, Japan, Taiwan and South Korea by chaining a custom remote-code-execution exploit with a Linux kernel privilege-escalation flaw. The company reported that the activity included three servers in a US government-affiliated environment; Palo Alto Networks’ Unit 42 independently verified the attacker’s tooling and results, according to Dream.
Dream said its researchers uncovered the operation on October 25 and found exploit-development artifacts, target lists, exploitation logs and about 40 post-exploitation scripts. The company said the attackers used two vulnerabilities in sequence to move from unauthenticated access to root privileges on affected systems. It described the PHP2Shell exploit as a custom, non-public implementation tailored to PAN-OS, rather than a copy of a known public exploit.
According to Dream, the first flaw, identified in its report as CVE-2026-109618 and CVE-2026-109619, affected PHP session handling on the PAN-OS management web server. A second vulnerability, CVE-2026-46300, dubbed Fragnesia, was used for kernel-level privilege escalation. The company said the attack targeted the management web server, which also fronts the GlobalProtect portal, and could reach root access in a single HTTP request without credentials on vulnerable builds.
After obtaining root access, the attacker focused on identity systems, Dream reported. Recovered artifacts showed credential extraction and Active Directory enumeration, and the operation’s target list singled out three servers in the government-affiliated environment. Dream said the artifacts traced activity from exploit development in a laboratory setting through persistent access to an organization’s internal directory. The report does not establish the full consequences of that access.
From Firewall Access to Directory Exposure
The reported chain matters because a network firewall’s management interface can provide a route beyond the device itself. If attackers gain privileged access to a firewall and then probe Active Directory, they may be positioned to seek credentials or map an organization’s internal accounts and systems. Dream’s findings indicate that the activity went beyond testing a vulnerability: recovered artifacts recorded post-compromise actions against identity infrastructure.
For organizations operating affected PAN-OS builds, the report highlights two separate response needs: addressing vulnerable software and investigating whether an exposed device was already compromised. A patch can close an entry point, but it does not by itself establish that earlier access has been removed or that credentials were not collected. Dream’s account makes the distinction particularly relevant for the government-affiliated environment, while not confirming what information, if any, was taken or what further actions followed.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Exploit Chain Worked
Dream described a two-stage attack. Its PHP2Shell component abused PHP’s session upload-progress handling on the PAN-OS management web server to execute commands. In the recovered implementation, the attacker used crafted requests and memory corruption to obtain code execution as the restricted nobody user, according to the report. Dream said the exploit was developed specifically for PAN-OS and relied on the affected server’s PHP configuration.
That initial access did not provide root privileges, so the attacker chained it with Fragnesia, a Linux kernel vulnerability. Dream said the second exploit altered authentication rules so that a root shell could be obtained without a password. The report says both stages were combined in one HTTP request. Palo Alto Networks is releasing fixed PAN-OS versions across affected branches, Dream said; the source material does not list the full version ranges or provide a complete patch schedule.
Dream also found signs of possible AI-assisted development in the operation’s infrastructure, including an installation of Claude Code, an offensive security platform called aiscan configured with Chinese language models DeepSeek and Kimi, and FOFA reconnaissance-platform API keys. The company cautioned that it had no direct evidence these tools wrote the exploit or scripts. It said code patterns across the scripts suggested AI assistance, but did not characterize the operation as a fully autonomous nation-state attack.
““We have no direct evidence that the AI tools were specifically used to write the exploit or the post-exploitation scripts.””
— Dream Security
Scope and Attribution Remain Open
The available report does not identify the affected organizations or provide a complete inventory of the 25 servers, their software versions, or their current status. It also does not say whether the attacker accessed, removed or altered data, or whether the credentials found in artifacts were used beyond the reported directory enumeration. The three government-affiliated servers are described without naming the organization.
Attribution is not confirmed. Dream reported indicators associated with Chinese tools and said the operation showed signs of AI-assisted development, but it did not establish who conducted the campaign or whether a government directed it. The source material also does not provide technical details from Palo Alto Networks’ independent verification beyond Dream’s statement that Unit 42 verified the tooling and results. The extent of any continuing access is not stated.
Patches and Incident Review
Palo Alto Networks is releasing fixed PAN-OS versions across affected branches, according to Dream’s October 29 update. Administrators should consult the vendor’s current security advisory for affected versions and remediation guidance; the information provided here does not specify a release timetable or enumerate every vulnerable build. Dream said it is sharing updates and collaborating on the investigation with Palo Alto Networks.
For organizations that used exposed management interfaces, the next steps include checking device versions, applying the vendor’s fixes and reviewing logs and systems for signs of exploitation or post-compromise activity. Investigations will need to assess whether credentials or directory data were accessed and whether any persistence remains. Further public updates from Palo Alto Networks or Dream may clarify the affected builds, the campaign’s scope and the status of compromised systems.
Key Questions
What did the attackers reportedly compromise?
Dream Security says the attackers rooted 25 PAN-OS firewall and management servers in the United States, Japan, Taiwan and South Korea. The report says three targeted servers were in a US government-affiliated environment.
How did the exploit chain work?
According to Dream, a custom PHP2Shell exploit first enabled command execution on the PAN-OS management web server. The attackers then used the Fragnesia kernel flaw to escalate privileges to root.
Has the attack been attributed to a particular group?
No confirmed attribution is provided. Dream found signs associated with Chinese-language tools and possible AI-assisted development, but said it had no direct evidence that the AI tools wrote the exploit or scripts and did not identify an operator.
What should PAN-OS administrators do?
Administrators should check Palo Alto Networks’ current advisory for affected versions and fixes, then review potentially exposed systems for signs of compromise. Applying a patch does not determine whether an earlier intrusion occurred.
Source: dreamgroup.com
