Dream flags lingering government exposure after hackers took over 25 servers

Two weeks after PHP2Shell patches arrived, at least 32% of government and military organizations in Dream’s observed sample still advertised affected software versions. The November 5 finding follows Dream’s discovery of attackers taking control of 25 servers through an exploit chain targeting exposed firewalls—a campaign Palo Alto Networks’ Unit 42 says it independently verified.

The follow-up adds evidence about how long potentially affected systems remain online after fixes become available. Dream compared publicly available Censys internet scans for the same systems on October 22 and through November 4. It selected systems using government, military and education domain identifiers, then focused its published figures on the government and military subset.

Older versions persist, but scans have limits

The remaining affected-version deployments spanned nine countries. Among military organizations in the sample, 57% still reported affected versions, compared with 26% among civilian government organizations. Nearly 80% of affected IP addresses reported end-of-life PHP branches—versions that no longer receive official PHP releases. Dream says those deployments may need a tailored repair or migration to a supported branch.

These are findings from a selected sample, not an estimate for governments worldwide or a count of confirmed vulnerable systems. Some systems stopped exposing their software version or disappeared from scans. Others may have received vendor backports—repairs applied to older software—without changing the version they advertised. An old version string therefore does not, by itself, prove that a system remains exploitable.

One exposed firewall opened a path inward

The attack campaign shows the consequences of a successful intrusion. PHP2Shell names two critical flaws that let attackers run their own instructions remotely. Dream says the attackers combined them with a Linux kernel flaw to obtain root access, the highest level of system control. TechRadar’s October 30 account identifies that second flaw as Fragnesia, tracked as CVE-2026-46300.

Dream’s follow-up says the actor filtered targets across four countries before concentrating on a US government-affiliated environment. The initial exploit chain completed in under 15 minutes. From the exposed firewall, the attacker reached an internal management server, extracted credentials and enumerated the organization’s directory, mapping information about its users and systems.

Unit 42’s October 29 threat brief provides vendor confirmation of the exploit chain, rather than another retelling of Dream’s findings. Palo Alto Networks said approximately 0.02% of its global installed base had internet-facing management interfaces configured and were impacted. It said its teams had individually contacted each affected customer.

The AI evidence is narrower than the evidence of compromise. According to TechRadar, Dream found Claude Code installed alongside AIscan, an offensive security platform configured with DeepSeek and Kimi models. Dream nevertheless assessed that the attack was not fully automated. The presence of those tools does not establish that AI independently carried out the intrusion.

Closing the entry point without breaking services

For legacy deployments, remediation can reach beyond installing an update. Dream describes older PHP runtimes embedded in security appliances or essential applications, where changing the runtime can require changes to libraries and integrations. Its follow-up argues that defenders must validate both security and continued operation: a successful build or one blocked exploit attempt is not enough.

For the observed firewall attack, Palo Alto Networks gives a concrete containment and patching path:

• Remove public internet access to management interfaces if enabled. The vendor says that access is not exposed by default.
• Restrict management access to trusted internal IP addresses.
• Apply available PAN-OS fixes. Palo Alto Networks says they interrupt this exploit chain and customers who applied them are not affected.