Dream Says Attackers Used PHP2Shell to Breach 25 Servers

Cybersecurity company Dream says attackers breached 25 servers by chaining PHP2Shell with a Linux kernel privilege-escalation flaw. Some of the servers allegedly belonged to organizations affiliated with the US government. TechRadar reports that the activity targeted Palo Alto Networks firewalls running older, vulnerable versions of PAN-OS.

According to Dream, the attacks began on October 23, 2026, with probes of organizations in the US, Japan, Taiwan, and South Korea. The attackers then focused on the firewalls and combined PHP2Shell with Fragnesia, a flaw that lets unprivileged users gain root access. Fragnesia is tracked as CVE-2026-46300.

Dream says the attackers ran about 40 custom post-exploitation scripts. The company also says that, within hours of compromising a US government-affiliated firewall, they moved into an internal network, compromised a third server using PHP2Shell, and began an Active Directory attack. Dream says the chain from an unauthenticated HTTPS connection to a persistent root webshell took under 15 minutes. Researchers believe the attackers may still have access.

Dream could not determine the attackers’ end goal from the recovered artifacts. It found Claude Code, AIscan configured with DeepSeek and Kimi models, and API keys for FOFA. The company believes the attackers used AI tools but that the campaign was not fully automated. Dream says FOFA was used to identify about 19,000 internet-connected Palo Alto Networks firewalls as potential targets.