Chained PHP2Shell exploit roots 25 servers, including US Government servers
- ID
- 41056
- Status
- summarized
- Published
- 29 Oct 2026, 6:42 PM
- Fetched
- 30 Oct 2026, 1:06 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers
- Source URL
- https://hnrss.org/best
Summary
- Score
- 6.5
- Created
- 30 Oct 2026, 1:07 PM
- Tags
- Audience
- developersai_agent_userssaas_founders
What happened
Dream researchers published an account of an intrusion that chained a PHP2Shell exploit (CVE-2026-109618/CVE-2026-109619) against the PAN-OS management web server with the Fragnesia kernel privilege-escalation bug (CVE-2026-46300) to root 25 Palo Alto Networks firewall and management servers across the US, Japan, Taiwan and South Korea, including three in a US government-affiliated environment. After rooting, the attacker pivoted into Active Directory, with recovered artifacts showing credential extraction and directory enumeration plus roughly 40 custom post-exploitation scripts. The post also claims evidence of AI-assisted attack tooling — Claude Code installed and an offensive platform called aiscan configured with DeepSeek and Kimi API keys — and Palo Alto's Unit 42 has reportedly verified the tooling.
Why it matters
The entry point was the PAN-OS management web server, which also fronts the GlobalProtect portal — if yours is reachable from the internet, this is a patch-now item, not a read-later one, and Palo Alto is shipping fixed builds across affected branches. The part most teams underrate is the pivot: root on the firewall became credential extraction and enumeration against Active Directory, so a compromised management plane is an identity compromise. Separately, the claimed attacker tooling (Claude Code plus an 'aiscan' platform wired to DeepSeek and Kimi keys) is a concrete example of agentic coding tools being pointed at live infrastructure — worth a policy answer on what your own agents are allowed to touch.
Discussion angle
Assume your firewall's management UI was internet-reachable for a week — what would you find in Active Directory logs, and would you know? Walk through what 'root on the edge device' actually buys an attacker in a typical small-team setup, and whether the AI-tooling claim changes how you gate agent access to production networks.