Dream reports PHP2Shell attack on 24 PAN-OS firewalls

Dream Research reported that attackers chained PHP2Shell with the Linux kernel flaw Fragnesia to gain root access to 24 Palo Alto Networks PAN-OS firewalls and one internal firewall management server. The internal server was compromised at 11:35 UTC on October 24, 2026, after the attackers pivoted through a firewall. Dream says it found campaign artifacts on October 25.

The reported campaign reached 25 systems

The total was 24 firewalls and one internal management server, not 25 perimeter firewalls. Dream placed the affected firewalls in the United States, Japan, Taiwan and South Korea. Three compromised systems were associated with a US government-affiliated environment.

Dream described a targeting funnel of about 19,000 exposed firewalls, around 5,000 that returned version information, and a filtered list of 240 targets. The reported campaign then gained root access on 24 firewalls. Dream says Palo Alto Networks' Unit 42 independently verified the attacker tooling and results.

How PHP2Shell and Fragnesia formed the chain

PHP2Shell refers to two PHP remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619. Dream says the attacker used a custom, nonpublic implementation tailored to PAN-OS. It targeted the management web server, which also fronts the GlobalProtect portal, and PHP's session.upload_progress mechanism.

The initial PHP code execution ran as nobody, a restricted system account. The attackers then used Fragnesia, a Linux kernel privilege-escalation flaw tracked as CVE-2026-46300, to obtain root, the system's highest-privilege account. Dream describes Fragnesia as exploiting the XFRM ESP-in-TCP subsystem and altering local authentication data.

Dream reported PHP 8.0.30 in PAN-OS 12.1 and 12.2 profiles. On a PAN-OS 11.1 profile with PHP 7.4.33, it verified PHP remote code execution as nobody in a lab; that profile was not calibrated for the full chain. NeoTeo previously covered AWS's pre-disclosure PHP2Shell observations, a separate thread in the same vulnerability story.

The firewall foothold led into internal systems

Dream says the attackers used an eight-port reverse SSH tunnel to reach internal services, including the firewall management server. The tunnel was configured to survive reboots. Two firewalls associated with the US government-affiliated environment were used for a deeper pivot.

Dream reported planted webshells on 22 of the 24 compromised firewalls, with no further recorded activity on those systems beyond the initial access. It also reported around 40 custom post-exploitation scripts, private keys recovered from PAN-OS filesystems, and network-topology information.

The attackers decrypted an LDAP service-account password and enumerated Active Directory users and groups, according to Dream. The investigation did not determine whether later password spraying, backdoor-account creation or SAML-key extraction succeeded.