Dream reported 25 compromised servers in an attack chaining PHP2Shell with the Fragnesia kernel privilege escalation. Its October 29 update identifies 24 PAN-OS firewalls and one management server across the United States, Japan, Taiwan and South Korea. Credential extraction and Active Directory enumeration were observed, but the complete downstream impact and attacker identity remain unresolved. Traces of AI tools do not prove AI authorship or state sponsorship. Related detection guidance also stresses validating suspicious activity to avoid false positives.