Chained PHP2Shell exploit roots 25 servers, including US government servers
A · Strong evidence A detailed forensic case from security vendor Dream Research, built on recovered attacker artifacts and independently verified by Palo Alto Networks' Unit 42; the AI-assistance claim is inferred, but the attack chain and campaign numbers are documented.
Summary based on the full text·Original: about 12 minutes to read
In short
A research post (26 October 2026, updated 29 October) by Dream Research, a cyber-defence vendor, describing a campaign found on 25 October. The attacker built a custom exploit for the PHP2Shell flaws in PHP, chained it with a Linux kernel privilege escalation, and rooted exposed Palo Alto Networks PAN-OS firewalls through the management web interface in one unauthenticated request. From one US government-affiliated network it tunnelled inside, rooted the central firewall management server and attacked Active Directory. The attack host had Claude Code installed and an offensive tool configured with DeepSeek and Kimi; Dream infers AI-assisted coding from the scripts' style but has no direct proof.
Key numbers
- 19,000internet-facing PAN-OS firewalls the attacker identified through the FOFA search engine
- 240firewalls left on the target list after filtering by country and exploitable version
- 25servers rooted: 24 firewalls plus an internal firewall management server
- ~40custom post-exploitation scripts whose style suggested AI-assisted development
- under 15 minutestime for the full chain from unauthenticated HTTPS request to persistent root webshell
As reported by the source.
English·Web page·opens dreamgroup.com
What it reports
- Funnel: about 19,000 exposed firewalls found, about 5,000 responded with version data, 240 targets in the US, Japan, Taiwan and South Korea on exploitable versions, 24 rooted.
- 22 of the 24 rooted firewalls were only given a 103-byte root webshell and left parked.
- The attacker held 11 version profiles with exact memory offsets, tested against lab VMs for some builds; 9 versions were exploitable.
- In the government-affiliated network the attacker built a boot-persistent 8-port reverse SSH tunnel, rooted the firewall management server less than 90 minutes after the second firewall, decrypted the LDAP service account password and enumerated every AD user and group.
- The domain had no account lockout, allowing unlimited password spraying; whether the spray, backdoor accounts or SAML key extraction succeeded is unknown.
- Unit 42 tracks the activity as CL-UNK-1280 and attributes it to a Chinese-speaking attacker in UTC+8; Dream does not name an actor.
How they got it
Proactive threat hunting with Dream's own autonomous research product, which led to the attacker's exploit code, target lists, logs and scripts. Palo Alto Networks' Unit 42 independently verified the tooling and results, and the vendor is releasing fixed PAN-OS builds.
Limits
- No direct evidence that AI tools wrote the exploit or scripts; the claim rests on code structure, commenting and consistency.
- Results of the identity attacks stayed on the compromised server and were not recovered.
- The post doubles as marketing for the vendor's products.
- Attribution indicators are circumstantial.
Why it matters for companies
The entry point was a firewall management interface exposed to the internet, and the damage came from what that device could reach: service account credentials, directory data and SSO configuration. Exploit development against a specific appliance, across many firmware versions, is now within reach of a small operation with coding agents. Firms should check that no appliance management interface is internet-facing, rotate any service credentials stored on network devices, and turn on account lockout in their directory.
Summary based on the full text. Read the original for the full argument and data.Read the original on dreamgroup.com