Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers

When Dream, the Israeli AI‑security outfit, lifted the lid on a fresh wave of Chinese‑backed attackers, the headline was all the drama we needed: a custom PHP2Shell exploit chained to a Linux kernel flaw, rooting 25 servers – including Palo Alto Networks firewalls tied to US government‑affiliated bodies. As a founder who’s been elbow‑deep in production for a decade, I’m not surprised that the attack chain was slick, fast and, frankly, a reminder that “best practice” checklists are only as good as the folks actually enforcing them.

From unauthenticated HTTPS to root in under 15 minutes

The attackers started with a single unauthenticated HTTPS request to a management interface that should never have been exposed. Within minutes they flooded the target with crafted multipart POST requests, corrupting PHP’s memory and forcing a predictable layout. A second request forged a stale session ID length, triggering an out‑of‑bounds read that exposed the base address of libphp.so. A final memory‑exhaustion step forced mod_data=NULL, giving them command execution as the “nobody” user. From there, the Fragnesia kernel flaw (CVE‑2026‑46300) vaulted them to root and planted a persistent webshell in a publicly accessible directory.

The entire chain – from that first HTTPS hit to a root webshell – wrapped up in under fifteen minutes. That’s not a “slow‑burn” exploit; it’s a rapid‑fire strike that leaves almost no window for detection, especially when the victim is a firewall whose primary job is to block inbound traffic, not monitor its own management plane.

Why the Palo Alto firewalls were the low‑hanging fruit

Dream’s report notes the compromised devices were running PAN‑OS 12.1 and 12.2, which ship with PHP 8.0.30 and a high memory limit. That memory ceiling is the very lever the attackers used to stage their memory‑corruption steps. In short, the platform’s default configuration handed the attackers a ready‑made launchpad.

What’s more, the firewalls were exposed to the internet – a classic mis‑step that any seasoned ops team should have flagged. The attackers leveraged FOFA, a Chinese‑origin asset search engine akin to Shodan, to fingerprint roughly 19,000 internet‑facing Palo Alto firewalls worldwide. That kind of reconnaissance is cheap, automated, and deadly when paired with a zero‑day chain.

The AI‑augmented toolbox: Claude Code, aiscan and Chinese models

The Dream team uncovered Anthropic’s Claude Code, an AI‑powered code assistant, alongside an offensive platform called aiscan configured with DeepSeek and Kimi models. They also found API keys for FOFA. This isn’t a sci‑fi scenario where AI runs the whole show; rather, it’s a force multiplier. The AI tools helped script the multipart POST floods, generate the precise memory‑layout payloads, and automate the post‑exploitation scripts – about 40 custom scripts were run after the initial breach.

For independent hosting providers, the takeaway is clear: AI tools are no longer the exclusive domain of the big hyperscalers. If a small team can stitch together an AI‑assisted exploit chain, they can also use the same tech to harden their own stacks. Ignoring the AI angle is a strategic blind spot.

The fallout: AD snooping, credential harvesting, and persistent tunnels

Once inside the firewalls, the attackers pivoted into the internal networks, targeting Active Directory. They stole credentials, enumerated users and groups via LDAP, and even decrypted the LDAP service account password, hard‑coding it into subsequent scripts. Password spraying across every domain account and attempts to create backdoor AD accounts were also on the menu.

Dream warns that the persistent tunnel into the US government‑affiliated network is likely still live. That means the attackers retain a foothold, able to revisit the compromised environment, exfiltrate data, or launch further lateral moves. For any provider whose customers rely on firewalls for perimeter defence, the risk isn’t just a one‑off breach – it’s a lingering backdoor that can be re‑activated at will.

What the vendor response tells us about supply‑chain risk

Palo Alto Networks’ Unit 42 independently verified Dream’s findings, confirming the custom tooling and the compromised PAN‑OS versions. Dream has been working with the vendor, but the public timeline shows the first US government‑affiliated firewall went down on October 23, crashed under roughly 900 MB of exploit traffic, and remained unresponsive despite 240 automated health checks over two hours.

This incident underscores a supply‑chain weakness: a single vulnerable component (PHP on the firewall) can open a gateway to the entire network. Vendors need to bake in secure defaults – lower memory limits, stricter management interface exposure, and mandatory patching cycles – rather than relying on customers to lock down their own attack surface.

Actionable steps for independent hosting operators

First, audit every management interface that’s exposed to the internet. If a firewall, router, or any web‑based admin console is reachable, block it at the perimeter or enforce strict IP allow‑lists. Second, trim PHP memory limits where possible; the high limit on PAN‑OS was a critical enabler for the exploit. Third, monitor for anomalous multipart POST traffic – the flood pattern is a tell‑tale signature of the PHP2Shell chain.

Fourth, deploy behavioural analytics that can flag rapid, multi‑stage exploit chains. The fifteen‑minute window is short, but a spike in POST size or a sudden surge in 5xx responses can be a red flag. Fifth, consider AI‑assisted detection: tools that can parse logs for patterns similar to the Dream‑reported chain can give you a head‑start before the attackers cement persistence.

Bottom line: the era of “just patch” is over

What this attack demonstrates is that a custom exploit, built from scratch and bolstered by AI, can bypass “best practice” checklists in seconds. Relying on vendor patch cycles or on the notion that a firewall is inherently secure is a dangerous illusion. Independent providers must adopt a defence‑in‑depth mindset: lock down management interfaces, enforce least‑privilege configurations, and continuously monitor for the kind of rapid, memory‑corruption attacks that Dream uncovered.

In the end, the attackers left a clear message: they can build bespoke tools, they can automate reconnaissance on a global scale, and they can stay in your network long after the initial breach. The only way to stay ahead is to treat every exposed service as a potential launchpad and to embed rigorous, real‑time monitoring into your operational DNA.

— Allan Ali, Founder

This article was produced with AI-assisted research and editorial support. Reporting is based on the source material cited below. Sources: The Register; theregister.com; Global1.News (01 November 2026).

By Allan Ali, Global1.News