Dream: attackers took over 25 network devices, three in a US organization's environment

Security researchers at Dream detailed a campaign that exploited PHP and Linux kernel flaws to gain full control of 25 network defense devices worldwide. Three were in an environment linked to a US organization, and one gave attackers a path into its internal network. The activity was observed on October 25, 2026.

• Of ~19,000 devices with exposed management pages, 240 were targeted and 25 compromised
• A second device provided a connection to the organization's internal network on October 24
• Attackers searched for service passwords and tried to create hidden accounts
• Attack infrastructure included Claude Code, FOFA credentials and the aiscan tool on DeepSeek and Kimi