PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
88
- Mentions · 7d12
- Mentions · 30d12
- All mentions13
- First seenAug 21, 2026
- Last mentioned19h ago
Timeline
13 articles · newest firstSuspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell
The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.
86
Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
84
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
84
Warp Panda used VMware ESX zero-day; firewalls rooted and crashed
CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.
84
Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
78
PHP2Shell flaws exploited on exposed Palo Alto management interfaces
Unauthenticated RCE hits internet-facing PAN-OS management; CISA set an October 31 deadline for kernel bug CVE-2026-46300.
88
Attackers chain PHP2Shell flaws to root 25 firewall servers
Dream says the chain, including kernel flaw CVE-2026-46300, rooted devices in the US, Japan, Taiwan, and South Korea in under 15 minutes.
76
Attackers chain PHP2Shell and kernel exploits for root on 25 servers
Dream says custom exploits for CVE-2026-109618, CVE-2026-109619 and CVE-2026-46300 reached government-affiliated firewalls and Active Directory.
76
Wordfence sees no confirmed WordPress compromises from PHP2Shell
From October 23 to 27 Wordfence logged about 77,600 PHP2Shell requests from more than 2,000 IPs and still urges a PHP update plus restart.
74
PHP2Shell campaign roots 25 servers, including U.S. government-linked hosts
Dream says a custom exploit plus a Linux kernel bug rooted firewalls in the U.S., Japan, Taiwan, and South Korea.
86
China-linked hackers root firewalls via PHP2Shell and Fragnesia
Dream says attackers exploited 25 of 19,000 internet-facing firewalls on October 23-24 and planted root webshells on 24.
80
AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure
NSA, CISA, FBI, DOE and EPA warn that actors use AI-generated Python scripts to exploit internet-exposed Siemens S7 PLCs at U.S. critical infrastructure.
80
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-4630016%7.8Shared-frag marker loss in Linux kernel skb coalescing (LPE)
- CVE-2026-76418<1%8.6Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth
- CVE-2026-41709<1%2.7Insufficient logging in VMware ESX for admin operations
Appears with
- PHPproduct · 7
- DeepSeekai model · 6
- Kimiai model · 6
- Palo Alto Networksvendor · 5
- Linux kernelproduct · 5
- CISAorganization · 5
- PAN-OSproduct · 4
- Unit 42organization · 3
- Claude Codeproduct · 2
- Fragnesiamalware · 2
- WordPressproduct · 2
- FBIorganization · 2
- OpenClawmalware · 1
- Morphisecorganization · 1
- U.S. government-affiliated organizationvictim · 1
- PHP Foundationvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.