TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Dream Security says attackers chained two vulnerabilities to gain root access on 25 internet-facing Palo Alto Networks PAN-OS servers across four countries. Artifacts show credential extraction and Active Directory enumeration at three servers in a U.S. government-affiliated environment; the attackers’ identity and the full impact remain unclear.
Dream Security says it found evidence that attackers used a two-vulnerability exploit chain to gain root access to 25 Palo Alto Networks PAN-OS servers across the United States, Japan, Taiwan and South Korea. Artifacts linked the operation to three servers in a U.S. government-affiliated environment, where investigators found evidence of credential extraction and Active Directory enumeration.
In a report updated October 29, 2026, Dream said researchers uncovered the operation on October 25. The chain combined a custom exploit for PHP2Shell, identified in the report as CVE-2026-109618 and CVE-2026-109619, with the Fragnesia Linux kernel privilege-escalation vulnerability, CVE-2026-46300. Dream said the combination could compromise vulnerable, internet-facing devices without credentials and obtain root access.
The affected entry point was the PAN-OS management web server, which also fronts the GlobalProtect portal. Dream said the operation’s recovered materials included target lists, exploitation logs and about 40 post-exploitation scripts. The report says that after rooting the firewalls, the attacker targeted Active Directory; recovered artifacts show credential extraction and directory enumeration, but do not establish the full extent of subsequent access or any resulting disruption.
Dream reported that Palo Alto Networks’ Unit 42 independently verified the tooling and results and that the vendor was releasing fixed PAN-OS versions across affected branches. The report does not name the affected versions in the supplied material. Administrators should consult Palo Alto Networks’ current advisory for affected builds and patch guidance rather than infer exposure from the vulnerability names alone.
How Firewall Access Reached Identity Systems
The reported activity matters because a firewall compromise can extend beyond the network device itself. Dream’s account says attackers used root access to move on to Active Directory systems, which can hold authentication and directory information used across an organization. The artifacts from the government-affiliated environment indicate credential-focused activity, though they do not by themselves prove that attackers obtained broad or lasting control of the organization’s domain.
For network defenders, the report points to two distinct tasks: determine whether a PAN-OS device ran an affected build and was exposed, then investigate whether it was compromised and what the attacker accessed afterward. Applying a fix addresses the vulnerable software, but incident responders may also need to review firewall logs, credentials and directory activity. Dream’s findings do not establish that all 25 servers belonged to one organization or that every compromised server was used to reach an internal network.
Products Worth Considering
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
LG UltraGear 45GX900A-B 45-Inch Curved OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Custom Chain on PAN-OS Management
Dream describes PHP2Shell as a custom, non-public exploit tailored to PAN-OS rather than a copy of a known public exploit. The report says it targeted PHP’s session upload-progress handling on the management server to achieve remote code execution. Because that initial execution ran with limited privileges, the attackers paired it with Fragnesia, a kernel exploit that Dream says enabled privilege escalation to root.
Dream also reported signs of possible AI-assisted development: Claude Code was installed, an offensive-security platform called aiscan was configured with Chinese large-language models DeepSeek and Kimi, and credentials for the Chinese reconnaissance service FOFA were present. The company explicitly said it had no direct evidence that AI tools wrote the exploit or scripts. It said code structure and comments suggested AI assistance, while cautioning that the operation did not appear to be a fully autonomous nation-state attack. Those observations do not identify the operator or establish state sponsorship.
“We have no direct evidence that the AI tools were specifically used to write the exploit or the post-exploitation scripts.”
— Dream Security
Scope and Operator Remain Unknown
The available report does not identify the attacker, specify the affected PAN-OS versions, or give a complete account of the 25 devices’ owners and roles. It also does not say whether the U.S. government-affiliated organization confirmed a breach, how long access persisted, whether credentials were used beyond enumeration, or whether data was taken or systems were disrupted. Dream’s description of AI assistance is an inference from artifacts, not direct proof of how the tools were used.
The supplied material says Palo Alto Networks was releasing fixes, but does not list release numbers, patch dates, or the full remediation guidance. Those details, as well as any additional findings from the joint investigation, remain to be confirmed through vendor advisories and subsequent reporting.
Patch Checks and Incident Review
Palo Alto Networks’ release of fixed PAN-OS versions is the next immediate milestone for administrators. Organizations should check the vendor’s advisory to determine whether their specific builds are affected, apply the relevant fixes, and review whether management interfaces were exposed. Systems with signs of compromise warrant investigation beyond patching, including examination of relevant logs and review of privileged credentials and Active Directory activity.
Dream said its researchers were sharing updates and collaborating with Palo Alto Networks on the investigation. Further vendor guidance or forensic findings may clarify affected versions, exposure and the extent of access. Until then, the number of rooted servers and the evidence of activity in a government-affiliated environment are confirmed as claims in Dream’s report, while the operation’s full impact and attribution remain unresolved.
Key Questions
How many PAN-OS servers were reportedly compromised?
Dream Security reported 25 rooted servers across the United States, Japan, Taiwan and South Korea. The report does not provide a full list of owners or device locations.
What vulnerabilities did the attackers chain?
Dream identified PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, paired with the Fragnesia kernel privilege-escalation vulnerability CVE-2026-46300.
Were U.S. government systems affected?
Dream said artifacts tied the operation to three servers in a U.S. government-affiliated environment. The report does not establish the full extent of access or describe the organization’s response.
Did AI write the exploit?
That has not been established. Dream found AI-related tools and configuration in the attack infrastructure, but said it had no direct evidence those tools wrote the exploit or post-exploitation scripts.
What should PAN-OS administrators do?
Check Palo Alto Networks’ advisory for affected versions and fixes, then assess whether exposed devices show signs of compromise. Organizations that find evidence of access should also investigate credentials and Active Directory activity.
Source: dreamgroup.com
