In an October 29 update, Dream Security identified Palo Alto Networks PAN-OS firewalls as the targets of its reported PHP2Shell campaign and said Unit 42 independently verified the attackers’ tooling and results. Dream says the attackers chained PHP2Shell with Linux kernel vulnerability CVE-2026-46300, rooted 24 firewalls and later attacked an internal firewall-management server.
How Dream says the exploit chain worked
Dream identifies the PAN-OS management web server, appweb, as the attack surface. The company says attackers used PHP2Shell, the name for PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, alongside CVE-2026-46300, a Linux kernel vulnerability it calls Fragnesia. The second flaw supplied the privilege escalation needed to gain root access on the targeted firewalls, according to Dream.
Dream says its custom exploit used version-specific profiles and precise memory offsets. Its profiles associated PAN-OS 12.1 and 12.2 with PHP 8.0.30. A PAN-OS 11.1 profile used PHP 7.4.33; Dream says it verified remote code execution as nobody in a lab but had not calibrated the full chain for that profile.
For PHP fixes and follow-up steps, operators can consult NeoTeo’s PHP2Shell patch and mitigation guide.
Why Dream counted 25 servers
Dream reports 24 rooted PAN-OS firewalls, plus one internal firewall-management server attacked later, for 25 servers in total. The company says its search began with roughly 19,000 internet-facing firewalls; about 5,000 returned version information. Geographic and exploit-profile filters narrowed that group to 240 targets, of which Dream says 24 were rooted.
Dream dates the first firewall compromise to October 23, 2026, at 18:14 UTC. That device crashed shortly afterward. The report places the exploitation of a second firewall connected to the same organization at October 24, 10:09 UTC, followed by the internal management server at 11:35 UTC. Dream says attackers used a tunnel from the firewall environment to reach that server.
Dream says 22 firewalls were left with webshells, while two associated with a U.S. government-affiliated environment received additional attention. It does not identify the organization.
What the recovered artifacts showed
Dream says recovered artifacts recorded root access, credential extraction and directory enumeration. The internal management server also enabled LDAP account and group enumeration; Dream says its researchers recovered the LDAP service-account password and private keys.
Dream could not determine whether password spraying, backdoor-account creation or SAML-key extraction succeeded. Those outcomes would affect how far the intrusion reached into the organization’s identity systems, but the report does not state that any of those actions succeeded.
The CVEs in CISA’s October 28 alert
CISA’s October 28 alert lists CVE-2026-41709, a Broadcom VMware ESX flaw, and CVE-2026-46300, a Linux kernel flaw involving missing initialization. CVE-2026-46300 is the kernel vulnerability Dream says was paired with PHP2Shell in the firewall campaign. CISA’s alert does not list CVE-2026-109618 or CVE-2026-109619.
