What happened
On October 29, 2026, Unit 42 said it independently verified the same attacker’s tooling and confirmed Dream’s reported results. Palo Alto Networks said the PHP2Shell vulnerabilities were being actively exploited against PAN-OS management interfaces exposed to the internet, that available fixes interrupt the observed chain, and that affected customers had been contacted. The observed chain combined CVE-2026-109618 and CVE-2026-109619 with CVE-2026-46300 to move from unauthenticated PHP code execution to root.
Dream reported 24 rooted internet-facing PAN-OS firewalls and one internal management server after filtering approximately 19,000 discovered devices to 240 targets. On October 23, 2026, Dream’s recovered artefacts show the first US government-affiliated PAN-OS firewall was rooted at 18:14 UTC and then crashed. On October 24, 2026, Dream’s artefacts show a second firewall was rooted at 10:09 UTC and an internal management server at 11:35 UTC. The batch runner planted a 103-byte PHP root webshell at /unauth/php/change_password.php, while persistence scripts ran from /usr/local/lib/.panops/.
Recovered activity included LDAP service-account password decryption, full directory enumeration, password spraying and attempts to create backdoor accounts and extract SAML signing keys. Dream said the exploit targeted profiled PAN-OS 12.1 and 12.2 builds running PHP 8.0.30, and that the chain could progress from an unauthenticated HTTPS connection to a persistent root webshell in under 15 minutes. The cited sources did not identify the affected US organisation or publish its network addresses.
Attribution posture: Dream described the activity as Chinese AI-assisted, and Unit 42 verified the same attacker tooling and reported results; no named threat group or government attribution has been established. Dream found Claude Code installed and an offensive-security platform named aiscan in the recovered infrastructure. aiscan was configured with DeepSeek and Kimi; model versions were not identified in the cited sources. The operator configured aiscan with DeepSeek and Kimi and retained FOFA API keys for reconnaissance. No direct evidence established that the AI tools wrote the exploit or the approximately 40 post-exploitation scripts. The cited source did not publish the specific indicators described as Victim identity and addresses.
Why this matters now
The enterprise decision has changed from accelerated vulnerability remediation to presumed-compromise triage for exposed management planes. Unit 42’s independent verification means defenders cannot dismiss the campaign as an uncorroborated research claim. An affected appliance sits at a privileged boundary, holds network configuration and service credentials, and can provide authenticated reach into identity systems even after its PHP and PAN-OS software has been updated.
The most consequential evidence is not the count of rooted devices but the observed path from an unauthenticated HTTPS request to a persistent root webshell, an internal firewall-management server and Active Directory operations. That path collapses traditional separation between perimeter security, network administration and identity security. Organisations operating exposed management interfaces therefore need a coordinated incident owner rather than parallel, unconnected patch tickets.
The recovered activity also demonstrates why exposure inventory must include embedded runtimes inside appliances. Teams may not identify a firewall as a PHP asset, while conventional server inventories may omit its management web server entirely. The response must reconcile external attack-surface data, appliance configuration, software versions, process telemetry, identity access and network-flow evidence before leadership accepts closure.
The decision for security leaders
Assign a single incident executive to coordinate network, vulnerability, identity and appliance owners. A patched firewall is not trustworthy until responders have cleared the management plane, its configuration store, connected management servers and every credential or signing key the appliance could access.
Require teams to separate three states in reporting: exposed, patched and compromise-cleared. Exposure establishes urgency, patching removes the known route, and forensic validation determines whether the adversary already established persistence. Dashboards that collapse these states create false closure and conceal the need for identity containment.
Treat internet reachability of management interfaces as an explicit, time-bound exception requiring executive approval. Where operational constraints prevent immediate isolation, document compensating access controls, enhanced monitoring, a named risk owner and an expiry measured in hours rather than an indefinite architectural waiver.
Evidence of closure
- CMDB and external-scan evidence show no public PAN-OS management interfaces.
- Version evidence shows every in-scope PHP and PAN-OS instance fixed.
- Forensic results clear /unauth/php/change_password.php and /usr/local/lib/.panops/.
- Flow analysis shows no unauthorised reverse SSH tunnel or SOCKS proxy remains active nationwide from PAN‑OS systems, to hunt control-plane persistence, review exposed credentials and rotate affected key material. to hunt control-plane persistence, review exposed credentials and rotate affected key material. to hunt C.
The Security.io assessment
The lead ranks above today’s other developments because a newly verified campaign converts a widely discussed software emergency into an enterprise compromise decision involving perimeter control, root access, persistence and identity infrastructure. The affected technology occupies a privileged network position, and the observed chain creates consequences that survive patch installation.
Unit 42’s verification materially strengthens confidence in the attacker tooling and PAN-OS impact. It does not resolve every claim about victim identity, the full number of organisations compromised or the success of attempted account creation and SAML-key extraction. Those uncertainties should narrow public conclusions, not delay containment of similarly exposed environments.
The AI evidence is operationally relevant but secondary. Installed tools and configured models demonstrate that AI tooling was available in the working environment, but the cited evidence does not establish that a model executed the exploitation or authored the attack chain. The defensible leadership conclusion is that attackers combined automation, reconnaissance and tailored exploitation efficiently; control priorities remain exposure reduction, detection, credential containment and evidence-based closure.
Questions for the morning meeting
- Can the organisation prove that no PAN-OS management interface is directly reachable from the public internet?
- Has the response team searched for compromise independently of PHP and PAN-OS patch status?
- Which LDAP, SAML, VPN and privileged credentials were accessible from each management plane?
- Who can authorise emergency isolation of an exposed firewall or management server?