Report says custom exploit rooted 25 PAN-OS servers

Dream researchers report that attackers chained two exploits to gain root access to 25 PAN-OS servers, then used access to a US government-affiliated environment to reach internal systems and target Active Directory. The full impact remains uncertain because the researchers could not determine whether several follow-on attacks succeeded.

• Dream says the attackers combined PHP2Shell with a kernel privilege-escalation exploit to root 25 PAN-OS servers in the United States, Japan, Taiwan and South Korea.· 1 source
• In a US government-affiliated environment, the attackers reached an internal firewall management server, extracted an LDAP service-account password and enumerated Active Directory users and groups. The researchers could not establish whether password spraying or attempted backdoor-account creation succeeded.· 1 source
• Dream says it found evidence of AI-related tools in the attack infrastructure but no direct proof they were used to write the exploits or scripts; it does not attribute the activity to a named actor.· 1 source