25 firewalls rooted from 19,000 scanned. I did the funnel math.

Dream Research published an attack report this week that reads like a funnel teardown: an attacker scanned roughly 19,000 internet-facing Palo Alto PAN-OS firewalls and ended up with root on 25 of them, including a US government-affiliated organization's internal network. The report is worth reading for the exploit chain. It is worth counting for the funnel, because the funnel is where the real lesson lives.

The chain, briefly

Two exploits, one unauthenticated HTTP request. PHP2Shell (CVE-2026-109618 / CVE-2026-109619) targets PHP's session.upload_progress mechanism on the PAN-OS management web server, which runs PHP 8.0.30 with a high memory limit. Four stages: flood the allocator with ~383MB of crafted multipart requests to force a predictable heap layout, leak a libphp.so base address out of bounds through a Set-Cookie header, apply ~500MB more memory pressure to leave a stale reference, then forge a HashTable entry whose destructor points at zif_system — PHP's system() — and get code execution as nobody.

Then Fragnesia (CVE-2026-46300), a Linux kernel XFRM ESP-in-TCP privilege escalation, overwrites the 774-byte /etc/pam.d/su with pam_permit.so, so su root succeeds without a password. SELinux confines the web server user, which is why the second exploit exists at all. Dream says the full chain, from unauthenticated HTTPS connection to persistent root webshell, completes in under 15 minutes.

The funnel, counted

Here is the campaign as Dream reports it, with the conversion at each step:

discovered (FOFA scan)      19,000
alive + version fingerprinted 5,000   26.3% of discovered
filtered (US/JP/TW/KR +      240       4.8% of alive
  PAN-OS 12.1/12.2, PHP 8.0.30)
rooted in automated batch      24      10.0% of filtered
plus internal mgmt server      25       0.13% of discovered

Read that last line again. The attacker did not beat 19,000 firewalls. They beat 10% of a carefully filtered 240 — and the filter did most of the work. Geography plus version matching cut 5,000 live devices to 240, a 95.2% reduction before a single exploit packet was sent. Target selection, not exploit reliability, is the campaign's real efficiency.

Two more numbers sharpen the picture. The batch runner exploited five targets at a time with a 30-minute timeout each, so 240 targets is at most 48 batches — a 24-hour worst case if everything timed out, and much less given the sub-15-minute chain. And of the 24 firewalls rooted in the batch, 22 were simply parked: webshell planted, nothing else done. That is 91.7% of the haul left idle, waiting. The operation's cost was concentrated on two servers in one US government-affiliated environment, where the attacker built an 8-port reverse SSH tunnel, rooted the internal firewall management server through it (server number 25), decrypted the LDAP service account password from the device config, and sprayed passwords against every domain user — possible without lockout, because the domain had lockoutThreshold=0, meaning no account lockout at all.

The calibration gap is the warning

The attacker carried 11 JSON version profiles — one per PAN-OS version tested — but only one was fully calibrated, meaning tested against a running VM of that version. The other 10 were provisional: offsets calculated from the binary, never verified live. And still 24 of 240 fell. A 10% hit rate on a mostly-uncalibrated exploit chain is the number that should worry defenders, because it says the chain did not need to be precise to be effective — it needed to be pointed at the right 240 devices.

The report is also honest about its own limits, and that honesty is worth repeating: the results of the Active Directory phase — whether the password spray found credentials, whether backdoor accounts were created, whether SAML keys were extracted — stayed on the management server's filesystem and were not among the recovered artifacts. Dream cannot determine the full extent of the compromise, and neither can I from this report. What the report does establish is the shape of the operation: a wide scan, a ruthless filter, a cheap chain, and a parked arsenal with one deep target.

The defensive moral is not "patch faster," though Palo Alto is releasing fixed PAN-OS versions and you should apply them. It is that an internet-facing management interface is not a firewall feature — it is the funnel's mouth. Nineteen thousand devices were discoverable through certificate fingerprints and HTTP response signatures. The attacker only needed 240 of them to match a version profile, and 24 of those to fall, to reach an internal domain. Close the management interface to the internet and the funnel never starts.

Sources: Dream Research, "Chained PHP2Shell Exploit Roots 25 Servers" (updated October 29, 2026); Palo Alto Networks Unit 42 verification as cited in the report. All percentages computed from the report's own figures.