Dream Research published an attack report this week that reads like a funnel teardown: an attacker scanned roughly 19,000 internet-facing Palo Alto PAN-OS firewalls and ended up with root on 25 of them, including a US government-affiliated organization's internal network. The report is worth reading for the exploit chain. It is worth counting for the funnel, because the funnel is where the real lesson lives.

The chain, briefly

Two exploits, one unauthenticated HTTP request. PHP2Shell (CVE-2026-109618 / CVE-2026-109619) targets PHP's session.upload_progress mechanism on the PAN-OS management web server, which runs PHP 8.0.30 with a high memory limit.…