Dream Research discovered a Chinese AI-assisted campaign that rooted 25 servers, including US government systems, by chaining a custom PHP2Shell exploit with a kernel privilege escalation against Palo Alto Networks PAN-OS firewalls. The attacker exploited the PAN-OS management web server, compromised Active Directory through credential extraction and enumeration, and has been verified by Palo Alto Networks Unit 42, which is releasing fixed versions.
Background
Palo Alto Networks PAN-OS firewalls are widely deployed in enterprise and government environments, making any compromise of their management interface a high-impact threat vector.
- Source
- hackernews
- Published
- Oct 29, 2026 at 06:42 PM
- Score
- 8.0 / 10