The report
Dream Group reports that attackers chained PHP2Shell with a Linux kernel privilege-escalation flaw on 25 selected firewall or management servers. Its October 26 investigation changes the evidence about exploitation, but it does not restore the earlier European-government attribution that Unit 42 withdrew, and it does not establish that AI wrote the attacker's exploit.
Two different evidentiary questions
The canonical PHP2Shell investigation covers AI-assisted vulnerability discovery, patched PHP engine flaws, earlier honeypot attempts and this new chain. Those facts should not be collapsed into one incident. The AI contribution is supported for the original research workflow; Dream's later observed exploitation has a separate operator and no demonstrated model trace.
According to Dream's technical account, a web-facing PHP service led to a process running with limited privileges. A second flaw in the Linux XFRM kernel subsystem then enabled a root-level effect on the tested targets. Dream reports 24 internet-facing firewalls and one internal government-affiliated management server. This is its reported outcome, not a count independently corroborated by each organization.
What the new evidence does and does not settle
Earlier telemetry showed attempted exploitation, often without a verified post-exploitation result. Dream's reported shell and privilege changes supply a stronger effect-level claim for a different environment. Neither observation proves that a previously named European-government intrusion began with PHP2Shell: the retraction remains in force for that allegation.
For operators, the chain puts separate boundaries in view. Fixing the PHP request-cleanup flaw addresses the initial entry; fixing the kernel escalation removes the later privilege jump. Network filtering alone is not proof that either vulnerable runtime has been repaired. The remaining work is to map affected firmware and kernel builds to the demonstrated chain, using victim-side evidence where available.