PHP2Shell、PAN-OS機器など25台がroot化 Fragnesiaと連鎖し米政府関連のADへ

PHP2Shell、PAN-OS機器など25台がroot化 Fragnesiaと連鎖し米政府関連のADへ

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page jp/news/innovatopia/cyber-security-cyber-security-news-119552, snapshot 20261030T121407Z. Copied byte for byte; every file's sha256 is in captures/20261030T121407Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

A Japanese security-trade analysis (Innovatopia, 30 October) of research by the security firm Dream Research, which on 26 October published traces of an attack that chained PHP2Shell with a Linux kernel flaw to gain root on 25 Palo Alto Networks PAN-OS firewalls and management servers. According to the article the attacker found about 19,000 exposed management interfaces with a scanning search engine and automatically attacked 240 devices in the United States, Japan, Taiwan and Korea; at a US government-linked organisation a first firewall was rooted on 23 October (UTC), a second and then the central management server were reached the next day, and the attacker began attacks on Active Directory, where Dream confirmed only the decryption of a service-account password and the listing of all users and groups. Unit 42 independently verified the attacker's tools and results; Palo Alto says management interfaces are not exposed by default, that about 0.02% of deployed devices exposed it and were affected and each was contacted, and published PAN-OS fixes by series from 25 to 29 October. Dream found an attack-support tool configured for AI models but says it has no direct evidence AI wrote the exploits or scripts, and the article notes Unit 42's 25 October withdrawal of its earlier AI-agent description from a European government case.

> Dreamは、侵害したファイアウォール24台のうち22台について、Webシェルの設置以外の活動は見つからなかったと報告しています。

_Curator's translation:_ "Dream reports that on 22 of the 24 compromised firewalls it found no activity other than the planting of a web shell."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell、PAN-OS機器など25台がroot化 Fragnesiaと連鎖し米政府関連のADへ". Selected mechanically, not read by a person.

Capture notes

Language ja. Secondhand on Dream Research's own report, which is the primary. The article describes the exploit chain and the privilege-escalation technique in detail; none of that is copied here. The breaking desk's coverage of the same report is in the vault (breaking-0005). Nothing in the page addresses an AI or hides text from a reader; it names AI tools found in the attacker's environment as part of the report.