tl;dr: Dream researchers uncovered a likely Chinese-nexus campaign that chained a custom PHP2Shell RCE (CVE-2026-109618/9) with the Fragnesia kernel LPE (CVE-2026-46300) to root 25 internet-exposed Palo Alto PAN-OS firewalls across the US, Japan, Taiwan, and South Korea in a single unauthenticated HTTPS request. After scanning 19,000 devices via FOFA and filtering to 240 targets, the attackers pivoted from a US government-affiliated firewall into the internal network, establishing a persistent reverse SSH tunnel, decrypting LDAP credentials, and launching Active Directory attacks. Tooling showed AI-assisted development using Claude Code, DeepSeek, and Kimi.