PHP2Shell chain roots PAN-OS firewalls and targets Active Directory
Dream Security said an apparent Chinese AI-assisted campaign chained the PHP2Shell vulnerabilities with the Fragnesia Linux privilege-escalation flaw to root 24 exposed Palo Alto Networks firewalls and an internal management server. Attackers then pivoted through a compromised US government-affiliated firewall, enumerated Active Directory, extracted credentials, and attempted actions including password spraying, backdoor account creation, and theft of a Keycloak SAML signing key. Palo Alto Networks Unit 42 independently confirmed the incident and tooling, while Dream found Claude Code, aiscan configured with DeepSeek and Kimi, and FOFA API keys; it found no direct evidence that AI wrote the exploit or scripts and did not characterize the operation as an autonomous nation-state campaign.
The confirmed exploit chain shows how a single exposed management interface can enable root access, internal pivoting, and Active Directory targeting, while the separate AI-related evidence remains circumstantial.
Custom PHP2Shell Exploit Chained with Kernel LPE to Root Firewalls in the Wild
On October 25, Dream researchers uncovered artifacts of what appeared to be a Chinese AI-assisted campaign that rooted 25 servers, including systems in a US government-affiliated environment. The attacker combined PHP2Shell with a kernel privilege-escalation exploit to compromise exposed systems.
The affected devices run specific versions of a large vendor’s firewall software. For security purposes, we are not disclosing the vendor or the affected versions, and the vendor has been notified.
The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration.
The operation illustrates how an exposed management interface can become a path into an organization’s identity infrastructure. For government defenders, vulnerability discovery is just the beginning, after which the real challenge extends from identifying vulnerable systems to understanding and containing the access a compromise makes possible.
The research below was conducted with proactive threat hunting using Dream’s autonomous cyber research product,Hero.
#Dream Security#Palo Alto Networks#PHP2Shell#Fragnesia#PAN-OS#Active Directory#Claude Code#aiscan#DeepSeek#Kimi#FOFA#Keycloak