Why “AI-Assisted” Needs Context In The Palo Alto PHP2Shell Story

🔍 Read the full analysis: Why “AI-Assisted” Needs Context In The Palo Alto PHP2Shell Story on ThorstenMeyerAI.com

Security company Dream reported that an attacker used recently disclosed PHP2Shell vulnerabilities, chained with a separate Linux kernel flaw, to gain root access to 24 Palo Alto Networks firewalls and compromise an internal server in a government-affiliated network. Dream found AI tools on the attacker’s systems, but said it had no direct evidence that AI wrote the exploit or attack scripts—a distinction that matters as the incident is described as “AI-assisted.”

Dream’s account, published October 26 and updated October 29, says an automated batch targeted 240 firewalls on October 23. The attacker reportedly obtained administrator-level root access on 24. On October 24, the attacker used two firewalls associated with a U.S. government-affiliated organization to reach an internal firewall management server, bringing the reported total to 25 compromised servers. Dream says the attacker then targeted the organization’s Active Directory system. Palo Alto Networks said its Unit 42 researchers independently verified the attacker’s tools and results.

The reported operation chained the two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, with Fragnesia, a Linux kernel privilege-escalation vulnerability identified as CVE-2026-46300. According to Dream, PHP2Shell provided command execution under a restricted account; Fragnesia then enabled the attacker to gain root access. Dream says the chain could be completed in under 15 minutes. These are reported findings from the company’s investigation, not a general measure of how quickly every vulnerable firewall could be compromised.

Dream says it found Claude Code installed on the attacker’s servers, along with DeepSeek and Kimi configured in an offensive-security platform called aiscan. Those findings establish that AI tools were present in the environment. They do not establish which tasks the tools performed, whether they generated any code, or whether they were involved in the specific firewall attacks.

Why AI Evidence Needs Careful Labels

The distinction between AI being present and AI being responsible affects how readers and security teams understand the incident. Calling the operation “AI-built” would imply evidence that the tools created the exploit chain; Dream says it has no direct evidence of that. Its assessment is also that the operation did not appear fully autonomous. The more limited description, “AI-assisted,” should therefore be treated as a characterization of the attacker’s environment, not a proven account of how the attack was carried out.

The reported compromise still matters without a demonstrated AI role. An attacker used a chain of vulnerabilities to move from exposed firewall management interfaces to persistent access and an internal network. Dream’s account says 22 of the 24 rooted firewalls were left with a hidden web shell, while the government-affiliated organization’s internal firewall management server was also reached. The potential consequences include continued access and risk to other systems managed through that server; the source material does not establish what data, if any, was taken.

For defenders, the practical lesson is not to wait for a definitive answer about AI. The reported access path involved internet-reachable management pages, a known kernel flaw and a period before fixed PAN-OS builds became available for affected branches. Reducing exposure and applying the relevant vendor fixes address the documented weaknesses regardless of whether AI sped up the attacker.

Popular right now

Ninja Flip Toaster Oven and Air Fryer, 8-in-1, Stainless Steel, SP151

AmazonView Latest Price

Vitamix Propel Series 750 Professional-Grade Blender, 4 Programs, Black

AmazonView Latest Price

Shark HydroVac MessMaster Corded Wet/Dry Vacuum, Mop & Self-Clean (WD161)

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

From Disclosure to Firewall Fixes

PHP released security updates on October 21, the same day Palo Alto Networks published an advisory about the flaws. According to the source account, PAN-OS includes its own copy of PHP, version 8.0.30, and fixed builds for the affected 12.1 and 12.2 branches arrived between October 27 and 29. Dream says the vendor’s advisory listed fixes as upcoming when it was published. Until the relevant firewall updates were available, the company’s stated protection was to keep the management interface off the internet.

The attack also used Fragnesia, a Linux kernel vulnerability disclosed in May 2026 with a public exploit, according to Dream’s timeline and the cited vulnerability records. The reported sequence began two days after the PHP fixes were released. Dream says its researchers found about 19,000 PAN-OS firewalls with internet-facing management pages, obtained version information from about 5,000, then narrowed the selection by country and version to 240 targets. Those figures describe the researchers’ account of target discovery; they do not mean all 19,000 devices were attacked or compromised.

On October 26, the U.S. Cybersecurity and Infrastructure Security Agency added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog and set a three-day deadline for federal agencies, according to the supplied material. That response reflects the reported exploitation and gives federal organizations a specific remediation requirement. It does not, on its own, establish the scale of exposure across all Palo Alto customers.

„“no direct evidence”“

— Dream

What the AI Tools Actually Did

The evidence described by Dream does not show whether Claude Code, DeepSeek or Kimi contributed to reconnaissance, exploit development, scripting, troubleshooting or another task. The tools’ presence is not proof of their use in the firewall attacks, and Dream explicitly says it has no direct evidence that AI generated the exploit or scripts. The extent to which automation or AI affected the speed or scale of the operation remains unknown.

Other details are also unresolved in the supplied account. It does not say whether the attacker accessed or removed data, how many organizations beyond the reported government-affiliated network were affected, or whether all reported web shells and other persistence mechanisms have been removed. The account gives a count of compromised systems and describes attacks on Active Directory, but it does not establish the final impact on the organization or its users.

The source material also does not provide a full public incident report from the affected organization or a detailed account from Palo Alto Networks of Unit 42’s verification methods. Those gaps limit independent assessment of the investigation’s scope and the consequences of the intrusion.

Patch Status and Incident Follow-Up

Organizations using affected PAN-OS branches should check Palo Alto Networks’ current advisories, apply the fixed versions relevant to their deployments and review whether management interfaces were exposed to the internet. They should also investigate systems for signs of compromise, including persistence, and review access to internal firewall management services and directory infrastructure. The source account identifies internet exposure as a key condition, but each organization needs to determine its own exposure and remediation status.

Federal agencies were given three days after CISA’s October 26 catalog action to address the two PHP2Shell flaws, according to the supplied material. The next developments to watch are confirmation that affected systems have been patched or otherwise secured, further information from Palo Alto Networks or the affected organization, and any additional evidence clarifying what role—if any—the AI tools played. Until then, the compromise is reported and the AI connection remains limited: tools were found, but their contribution to the attack has not been established.

Key Questions

What happened in the PHP2Shell incident?

Dream reported that an attacker chained two PHP2Shell flaws with the Linux kernel vulnerability Fragnesia to gain root access on 24 Palo Alto Networks firewalls. The attacker then reportedly used systems linked to a U.S. government-affiliated organization to reach an internal firewall management server.

Has it been proven that AI created the exploit?

No. Dream said AI tools were found on the attacker’s servers but that it had no direct evidence they wrote the exploit or scripts. The available account does not establish what the tools did during the operation.

How many servers were reportedly compromised?

Dream reported 25 servers: 24 firewalls and one internal firewall management server. The report says the attacker also targeted the organization’s Active Directory, but it does not quantify any resulting data loss.

What should Palo Alto firewall operators do?

Operators should consult Palo Alto Networks’ advisories and install the fixed PAN-OS versions that apply to their systems. The source material also says to keep management pages off the public internet and to investigate potentially compromised systems.

What is still unknown about the attack?

The specific role of the AI tools, whether data was accessed or removed, and the full scope of affected organizations remain unclear in the supplied account. Dream’s findings establish its reported observations, but do not answer those questions.

Source: ThorstenMeyerAI.com