The source content is largely a web page dump containing a news article with usable reporting, so I can write a brief from it.
Dream, a cyber defense platform provider, reported that a suspected Chinese nation-state actor chained the PHP2Shell exploit with a Linux kernel privilege-escalation vulnerability to gain root access to 25 Palo Alto Networks (PAN) firewall and management servers. According to Dream, the servers were located across the United States, Japan, Taiwan, and South Korea. The researchers focused on three servers in a US government-affiliated environment, which they said gave the attacker persistent access to a US government organization's internal Active Directory domain.
Dream cited several indicators of Chinese state involvement. It pointed to the narrow targeting of four countries it described as primary strategic adversaries and intelligence targets for Chinese state-aligned operations. It also noted that the attacker used Chinese-based services, including the large language models DeepSeek and Kimi and the reconnaissance platform FOFA. The researchers said the campaign ran from 23 to 24 October.
Palo Alto Networks' Unit 42 verified Dream's findings in a blog published on October 29. Unit 42 said about .02% of its