---
title: "Suspected Chinese attackers rooted Palo Alto Networks firewalls as the stock ran 14% on AI fear"
description: "Dream Security's report, verified by Palo Alto's own Unit 42, puts suspected state hackers inside US government-affiliated firewalls one week after the stock's 14% run priced AI-found flaws as a bigger-budget story."
publisher: "The Inference"
section: "Security"
published: 2026-10-30T15:17:27.997Z
modified: 2026-10-30T15:17:27.997Z
canonical: https://theinference.org/article/suspected-chinese-attackers-rooted-palo-alto-networks-firewalls-as-the-stock-ran-14-on-ai-fear
language: en
keywords: "Cybersecurity, Palo Alto Networks, China, Hacking, AI"
---

# Suspected Chinese attackers rooted Palo Alto Networks firewalls as the stock ran 14% on AI fear

> Dream Security's report, verified by Palo Alto's own Unit 42, puts suspected state hackers inside US government-affiliated firewalls one week after the stock's 14% run priced AI-found flaws as a bigger-budget story.

## One HTTPS request, root in 15 minutes

On October 23 an unauthenticated HTTPS request landed on the management interface of a [Palo Alto Networks](https://theinference.org/markets/companies/palo-alto-networks) firewall belonging to a US government-affiliated organization [1]. Within 15 minutes the device was running a persistent root webshell [1].

Dream Security, an Israeli AI cybersecurity startup, reports that a suspected China-nexus crew then [rooted 25 servers across the US, Japan, Taiwan and South Korea](https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456) on October 23 and 24, chaining PHP2Shell, two 9.2-severity unauthenticated code-execution flaws in PHP, the language under roughly 70% of websites, with Fragnesia, a Linux kernel privilege-escalation bug [1]. [The first government firewall crashed under about 900 MB of exploit traffic](https://www.infosecurity-magazine.com/news/chinese-us-government-chained-php2/); the attacker probed it 240 times over two hours, then took a second firewall on October 24 [1].

## Inside the network: tunnels, password sprays and SAML keys

Inside, the crew built a reverse SSH tunnel, reached Active Directory, sprayed passwords, and tried to create backdoor accounts and extract SAML signing keys; Dream cannot confirm those attempts succeeded [1]. Dream's warning is the operative fact: the tunnel is "likely still" running [1].

*Chart: **From 19,000 fingerprinted firewalls to two US government servers in 48 hours** Bar chart of the attack funnel: 19,000 firewalls fingerprinted via FOFA, 240 on the target list, 25 exploited, 24 rooted, 2 with persistent access*

*Dream Security's reconstruction of the October 23 to 24 operation: firewalls fingerprinted with FOFA, filtered to a target list, exploited and rooted; two held persistent access at last report. Sources: The Register, Infosecurity Magazine, SecurityWeek. [1][5][6]*

## The rally that priced the same threat as revenue

The week before the Dream report, [Palo Alto's stock ran 14% while the S&P 500 went nowhere](https://theinference.org/article/palo-alto-rallies-on-the-bug-inside-its-own-firewall-before-the-fix-exists), on the thesis that AI-found flaws mean bigger security budgets [3]. CEO [Nikesh Arora](https://theinference.org/markets/people/nikesh-arora) [called handing AI to attackers "a nuclear sort of bomb"](https://finance.yahoo.com/markets/stocks/articles/palo-alto-soars-14-week-182354193.html); [Amazon](https://theinference.org/markets/companies/amazon) CEO [Andy Jassy](https://theinference.org/markets/people/andy-jassy) said AI had cut the gap between finding a vulnerability and using it "from weeks down to minutes" [3].

[Palo Alto's own October 22 advisory listed PAN-OS as affected](https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/) with most fixes dated for October 27 to 30, and [The Inference covered that no-fix window the same day](https://theinference.org/article/palo-alto-networks-has-no-pan-os-fix-for-php2shell-calls-it-9-2-and-sells-a-paid-virtual-patch) [8]. Forward price-to-earnings reached 96x on October 27, against 82x mid-month and a 57x five-year average [3].

## Then the vendor's own researchers verified the breach

On October 28 Palo Alto [confirmed active exploitation of internet-exposed management interfaces](https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html), and said customers who patch or keep management off the public internet are not affected; fewer than 0.01% of the installed base has such interfaces exposed [4]. On October 29 its Unit 42 threat research arm independently verified the attacker tooling and confirmed Dream's reported results [1].

## Claude Code, DeepSeek and a 19,000-firewall target list

The recovered toolkit reads like a frontier-lab catalog: [Anthropic](https://theinference.org/markets/companies/anthropic)'s Claude Code installed, an offensive platform configured with Chinese models [DeepSeek](https://theinference.org/markets/companies/deepseek) and Kimi, and FOFA, a Chinese Shodan-style asset search, used to fingerprint about 19,000 internet-facing Palo Alto firewalls [1]. From that pool the crew filtered 240 targets, [rooted 24, and kept persistent access on two](https://www.securityweek.com/china-linked-hackers-exploit-php2shell-to-root-firewalls/) [5][6]. Amazon's honeypots had [logged PHP2Shell probes from October 17](https://www.unite.ai/dream-reports-php2shell-attack-chain-that-compromised-25-servers/), four days before the flaws were even disclosed [9].

*Chart: **The rally lifted Palo Alto's forward P/E to 96x, far above its own history** Bar chart of forward P/E multiples: Palo Alto 96x on October 27, 82x mid-October, 57x five-year average, CrowdStrike 161x mid-October*

*Forward price-to-earnings multiples for Palo Alto Networks in October 2026 and its five-year average, against CrowdStrike in mid-October. Source: Yahoo Finance. [3]*

## The November print decides what this is worth

Palo Alto [shipped fixes for every vulnerable PAN-OS branch by October 30](https://theinference.org/article/two-firewall-vendors-patch-in-parallel-while-attackers-already-hold-the-keys), and says GlobalProtect is not impacted [4]. Dream says the attacker still holds the 19,000-firewall target list and can revisit it as it profiles more PAN-OS versions [1].

Fiscal first-quarter results, due mid-to-late November, guide next-generation security ARR at $9.54 billion to $9.56 billion [3]. That report is where the market rules on the question the incident poses: whether a suspected state crew inside the flagship product is the strongest sales case the AI-threat thesis ever got, or the bill arriving at 96 times earnings [3].

## Takeaway

Suspected China-nexus hackers chained the 9.2-rated PHP2Shell flaws with a Linux kernel bug to root 25 servers, including a firewall at a US government-affiliated organization, and Palo Alto's own Unit 42 verified the tooling; the fiscal Q1 print in late November decides whether the breach sells more security or bills it at 96 times earnings.

## Sources

1. [The Register, Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers, 29 October 2026](https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456)
3. [Yahoo Finance, Palo Alto Soars 14% in a Week as CEO Warns of AI's "Nuclear Sort of Bomb", 29 October 2026](https://finance.yahoo.com/markets/stocks/articles/palo-alto-soars-14-week-182354193.html)
4. [The Hacker News, Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces, 29 October 2026](https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html)
5. [Infosecurity Magazine, Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit, 30 October 2026](https://www.infosecurity-magazine.com/news/chinese-us-government-chained-php2/)
6. [SecurityWeek, China-Linked Hackers Exploit PHP2Shell to Root Firewalls, 28 October 2026](https://www.securityweek.com/china-linked-hackers-exploit-php2shell-to-root-firewalls/)
8. [Help Net Security, What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers, 22 October 2026](https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/)
9. [Unite.AI, Dream Reports PHP2Shell Attack Chain That Compromised 25 Servers, 27 October 2026](https://www.unite.ai/dream-reports-php2shell-attack-chain-that-compromised-25-servers/)


---

Suspected Chinese attackers rooted Palo Alto Networks firewalls as the stock ran 14% on AI fear — The Inference. Canonical: https://theinference.org/article/suspected-chinese-attackers-rooted-palo-alto-networks-firewalls-as-the-stock-ran-14-on-ai-fear