A researcher-reconstructed campaign used PHP2Shell to take control of 24 exposed firewalls, then reached an internal management server in a US government-affiliated network. What attackers did after gaining that access is only partly known.

The first firewall went down after the attackers broke in. They waited for it to come back. When it did not, they went after another device belonging to the same apparent target. Less than 90 minutes after compromising that second firewall on October 24, they were attacking a server deep inside the organization's management network.

That sequence is described in recovered logs and tools analyzed by security company Dream Research. The company says the organization showed signs of US government affiliation. The victim has not been publicly named in the research. Palo Alto Networks' Unit 42 said on October 29 that it had independently verified the attacker's tooling and confirmed Dream's reported results.

The entry point was a set of critical PHP vulnerabilities known as PHP2Shell. But the story is not simply about defective code. It is about what happened once an administrative interface on a perimeter firewall was reachable from the internet: a machine intended to enforce access boundaries became an entry point into the identity systems behind them.

The first firewall failed. The attackers adapted.

Dream's reconstructed timeline begins well before the public warning. Its researchers found evidence of exploit preparation and version testing, followed by a search for reachable Palo Alto Networks management interfaces. The attackers discovered about 19,000 candidate systems, identified software versions on roughly 5,000 that responded, and narrowed a target set to 240 matching their preferred locations and exploit profiles.

Those numbers describe an attacker's selection process, not 19,000 confirmed vulnerable firewalls. The attempted batch yielded 24 compromised internet-facing firewalls in the United States, Japan, Taiwan and South Korea, according to Dream. Twenty-two were left with malicious web access but no observed follow-on pivot. Two associated with one US target drew further attention.

On October 23, one of those firewalls was compromised at 18:14 UTC and then stopped responding. The research attributes the crash as likely related to the exploit's heavy memory use; that causal explanation is an assessment, not a public statement from the operator. The recovered logs show the attacker checking repeatedly for the machine to return.

On October 24 at 10:09 UTC, a separately targeted firewall in the same environment was compromised. From it, the attacker established a reverse tunnel toward internal systems. By 11:35, the same exploit chain had been deployed against an internal firewall management server accessible through that tunnel. That brought the count to 25 compromised systems: 24 external firewalls and one internal management server.

How a web flaw became root access

PHP2Shell refers to two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in PHP's handling of certain out-of-memory and error conditions. The defects can produce memory corruption that allows an attacker to execute code. In this campaign, Dream says a custom version-specific exploit targeted the PHP component serving the PAN-OS management interface.

The initial execution did not grant unrestricted control of the operating system. The attackers chained it with a separate Linux kernel weakness, CVE-2026-46300, dubbed Fragnesia, to elevate privileges. That second stage is what reportedly turned code execution inside a constrained web service into root-level control of the device.

A firewall has two very different jobs: inspect and forward network traffic, and let administrators change the rules that govern it. The compromised surface here was the latter—the HTTPS management interface and XML API—not a general assertion that ordinary firewall traffic or GlobalProtect connections were directly exploitable. Palo Alto's advisory expressly says the GlobalProtect portal and gateway are not affected by these PHP defects.

A critical distinction in the exposure figures — Palo Alto Networks reported more than 22.6 million internet-exposed instances potentially vulnerable to the underlying PHP vulnerabilities across the wider web. That is not a count of exposed Palo Alto firewalls. The 19,000, 5,000, 240 and 25 figures in Dream's account refer to separate stages of one attacker's campaign.

The identity system was the next objective

The attacker's tunnel changed the risk dramatically. A firewall configuration revealed internal network addresses and a path to the management server. According to Dream, the attackers used root access on that server to recover the password of an LDAP service account stored in an encrypted configuration. With the device's privileged access, the researchers say, the attacker could decrypt it and query Active Directory.

The recovered material shows a complete listing of directory users and groups. It also shows commands or scripts for password spraying, creating backdoor accounts, testing privilege paths and attempting to extract sign-on keys. There is an important evidentiary line here. The research confirms the service-account credential extraction and directory enumeration; it does not establish that password spraying succeeded, that backdoor accounts were created or that SAML keys were stolen. Dream says the results of those later operations were not among the artifacts it recovered.

That uncertainty does not make the earlier access harmless. A compromised directory credential and a list of organizational accounts give an intruder information and a foothold that persist beyond the vulnerable web page. Equally, it would be irresponsible to describe a completed takeover of the directory without evidence that it happened.

The AI claim deserves more caution than the headlines suggest

Dream found a Claude Code installation, an AI-assisted offensive security platform configured for Chinese language models, and Chinese-language material on the attacker's infrastructure. Its researchers said the consistency of roughly 40 scripts suggested possible AI assistance. They also explicitly acknowledged they had no direct proof that these tools wrote the exploit or the post-exploitation code.

The company cited targeting patterns and language indicators as consistent with a Chinese nexus, while declining to name an attacker. Unit 42 tracks the activity under its own designation. Neither the presence of AI tooling nor the language used by an operator independently proves sponsorship by a government. Treating a plausible intelligence assessment as a confirmed state attribution would exceed the public record.

The exposure that should not have existed

Palo Alto Networks says attacks against public-facing management interfaces are active and rates the exposure critical. Its security advisory lists fixed hotfix versions for supported PAN-OS branches and recommends restricting management access to trusted internal systems. The vendor says its fixes interrupt the exploit chain observed by Dream.

That advice addresses the entry point. It does not answer what happened on a device before a fix was applied. For an affected organization, the relevant records extend beyond the firewall: whether a tunnel was created, whether management credentials were exposed and what the directory servers recorded afterward. Those are incident-response questions, not proof that every exposed installation was breached.

The public timeline leaves a disturbing distinction intact. In its wider campaign, the attacker left most compromised firewalls as dormant footholds. In the government-affiliated environment, the attacker had a reason to keep moving, and did so quickly. The perimeter failed first. The more consequential boundary was the one between managing security equipment and accessing an organization's identities.

References and reporting notes

This article is based on Dream's recovered attack artifacts and Palo Alto Networks' independent vendor confirmation and advisory. Tech Little Brawta did not reproduce the exploit, inspect the victim's network or obtain a statement from the unnamed organization. Activities shown in scripts are distinguished from proven results.