From the Palo Alto Networks edition of October 29, 2026
Dream Research: custom PHP2Shell plus Fragnesia exploit chain rooted 25 internet-exposed PAN-OS firewall and management servers, then pivoted into a US government-affiliated Active Directory
Dream (Dream Research team) · Cybersecurity threat research / network firewalls · United States, Japan, Taiwan and South Korea targets; researcher based in Israel
- Publisher
- Dream Research
- Original publication
- Dream Research blog, published late October 2026 (cited by Unit 42 on Oct. 29, 2026)
- Source retrieved
- 2026-10-30
- Event date
- 2026-10-24
What happened
Dream reports recovering a full attack kit: a custom, non-public PHP2Shell exploit (CVE-2026-109618/109619) tailored to the PAN-OS management web server, chained with the Fragnesia Linux kernel privilege escalation (CVE-2026-46300) to get root from one unauthenticated HTTPS request in under 15 minutes. The attacker used FOFA to find about 19,000 internet-facing PAN-OS management interfaces, about 5,000 answered a version scan, 240 were filtered to the US, Japan, Taiwan and South Korea on PAN-OS 12.1/12.2, and 24 firewalls were rooted with a webshell. Two belonged to a US government-affiliated organization (CAC authentication, government-style naming); from the second, the attacker tunneled in, rooted the internal firewall management server (25th server), decrypted the LDAP service account password and ran LDAP enumeration and password spraying against a domain with no lockout. Dream says the tunnel is likely still active. It saw AI tooling (aiscan configured with DeepSeek and Kimi) but no direct evidence AI wrote the exploit, and says it was not a fully autonomous attack.
Why it matters
State, county, city and campus networks run large PAN-OS estates; any agency that exposes the firewall management interface to the internet is in the targeted population, and the reported pivot path (firewall to central management server to Active Directory) is the same one a public-sector network would present.
Evidence and measured results
Opened and read the Dream Research post in full: exploit stages, version profiles, campaign funnel figures, timeline and post-exploitation steps. Corroborated by Unit 42’s Oct. 29 update stating it independently verified the attacker’s tooling and results, and by The Register’s Oct. 29 report.
Limitations and uncertainty
Single private researcher’s account based on recovered artifacts; the government organization is unnamed and its level (federal, state or local) is not stated. Attribution to Chinese state-aligned actors is Dream’s inference from targeting. Dream sells an autonomous research product used in this hunt. Counts are from attacker artifacts, not a census.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-30; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies cannot easily prove their PAN-OS management interfaces are unexposed or that a compromised firewall has not led into Active Directory.
- Stakeholders
- State and local CISOs
- Network operations managers
- Identity and directory administrators
- University information security officers
- Risk and audit offices
- Discovery questions
- Is any PAN-OS management interface or GlobalProtect portal reachable from the internet today, and how was that verified?
- Which LDAP or service accounts are stored on firewalls and central managers, and when were they last rotated?
- What is the Active Directory account lockout policy?
- Who would run a compromise assessment on a firewall if patching came after exposure?
- Value hypothesis
- Interpretation: a short exposure-and-compromise review could close the specific path Dream documented and give leadership evidence of remediation, but it does not guarantee no prior compromise.
- Potential engagement
- A two-to-four-week firewall management exposure review, credential rotation plan and targeted hunt for the artifacts Dream described, scoped to the agency’s PAN-OS estate.
- Unsupported claims
- That any named state or local government was compromised
- That patched or properly configured customers were affected
- That AI autonomously ran the attack
- Any quantified savings or risk-reduction figure
Pre-sales engineering
Role takeaway
- Fit
- Directly relevant to any SLED entity running PAN-OS 12.1 or 12.2 on PA-Series, VM-Series or Panorama with management reachable from untrusted networks.
- Architecture and integration
- Management-plane isolation (jump box or trusted IP allowlist), separation of central firewall managers from perimeter devices, and directory integration through least-privileged service accounts.
- Prerequisites
- Complete inventory of PAN-OS devices and versions
- External attack-surface scan results
- List of credentials stored in device configurations
- Access to firewall and AD logs for the Oct. 8 onward window
- Constraints
- Fixes must be applied per maintenance branch; unsupported versions need upgrades
- Vendor-run devices or shared state networks may require coordination with another entity
- Recovered artifacts did not show the outcome of spray or SAML extraction attempts
- Security
- Treat any device exposed during the window as potentially compromised: hunt for webshells under publicly reachable paths, reverse SSH tunnels and boot hooks, then rotate decrypted-at-rest secrets.
- Proof of value
- External scan confirms no management interface reachable from the internet
- Every device on a fixed PAN-OS build
- Hunt of each previously exposed device for webshell and tunnel artifacts
- AD audit for new accounts, spray patterns and lockout setting
Delivery
Role takeaway
- Work
- Run exposure removal, patching, credential rotation and compromise hunting across the firewall estate and connected directory.
- Dependencies
- Vendor fixed releases per branch
- Change windows for firewall upgrades
- Identity team availability for credential rotation
- Logging retained back to early October
- Ownership
- Network operations owns the firewall estate; the CISO office owns the hunt and incident decisions; directory administrators own credential rotation.
- Skills and adoption
- Staff need to recognise management-plane exposure in configurations and read post-exploitation artifacts; small teams may need incident-response support.
- Governance checkpoints
- Exposure confirmed closed before declaring the incident handled
- Decision on whether to report to state fusion center, MS-ISAC or CISA
- Post-incident review of management-plane policy
- Acceptance criteria
- Proposed: zero internet-reachable management interfaces on re-scan
- Proposed: 100% of PAN-OS devices on fixed builds within the agreed window
- Proposed: all firewall-stored service credentials rotated
- Proposed: documented hunt result for every previously exposed device
- Risks
- Persistent tunnel survives patching
- Stolen directory credentials used later
- Upgrade outages on critical perimeter devices
- Over-reliance on a single researcher’s indicators
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
The exposed surface is the PAN-OS management web server (which also fronts the GlobalProtect portal). Management-plane exposure, central firewall managers reachable from perimeter devices, and LDAP service accounts stored on the firewall all widen blast radius.
Governance
Who approves, reviews and stays accountable for outcomes?
Shows why policy must forbid internet-facing management interfaces and require periodic external-exposure checks, and why patch SLAs alone are not enough when a chain is weaponized before fixes land.
Security and privacy
What data, permissions and controls need testing?
Root on the firewall exposes the master key that decrypts stored credentials; directory enumeration and SAML signing-key extraction attempts point at identity compromise. Dream could not recover results of the spray, backdoor-account or SAML steps.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Small public IT teams that manage firewalls part-time are most likely to leave management exposed and least able to run compromise assessments; the 15-minute chain leaves little response time.
Procurement
What should contracts, pricing and exit terms secure?
Agencies may need incident-response retainers, external attack-surface monitoring and managed firewall services scoped to verify configuration hygiene, not just product licenses.
Operating model
Which teams own the service once it runs?
Network, identity and security operations must act together: closing management exposure, rotating LDAP and service credentials, and hunting in Active Directory after any perimeter-device compromise.
Publication history
- 2026-10-29Palo Alto Networks · Issue 018 resources
Stable resource ID: dream-php2shell-fragnesia-chain-roots-pan-os-firewalls-us-government-affiliated-20261029