Attackers chain PHP2Shell flaws to root Palo Alto PAN-OS firewalls
Hunt.io says 24 perimeter firewalls and one internal management server were compromised, including a US government-affiliated environment.
84
Product
PAN-OS
- Mentions · 7d12
- Mentions · 30d41
- All mentions47
- First seenSep 8, 2026
- Last mentioned1d ago
Timeline
47 articles · newest firstPHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
88
Suspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell
The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.
86
Palo Alto confirms PHP2Shell attacks on exposed PAN-OS management
Unit 42 verified tools that pair the PHP flaws with kernel bug CVE-2026-46300 for root; about 0.02% of the installed base was exposed.
86
php2shell RCE confirmed on honeypots and some network appliances
Public PoCs often fail unless tuned to one PHP build, but shared appliance images let one exploit hit many devices.
82
Attackers chain PHP2Shell with Fragnesia kernel bug for root
Dream Security says the chain rooted Palo Alto firewalls and reached Active Directory on 25 servers, three tied to the US government.
84
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
84
PHP2Shell flaws exploited on exposed Palo Alto management interfaces
Unauthenticated RCE hits internet-facing PAN-OS management; CISA set an October 31 deadline for kernel bug CVE-2026-46300.
88
Eclypsium report details exploited flaws in firewalls, VPNs and network appliances
InfraTrust tracked 133 new advisories covering 2,813 vulnerabilities in a month; 16 advisories involved actively exploited KEV-listed flaws.
90
CISA lists Brotli Node2Shell flaw as honeypots log attempts
CVE-2026-111497 hits Brotli 1.0.3 through 1.2.0; US civilian agencies must address it by November 10.
84
Palo Alto says Brotli flaw can hit some PAN-OS firewalls (CVE-2026-111497)
The CVSS 9.2 decoder bug needs Brotli inspection plus decryption; no exploitation is known, and hotfixes are only estimated.
64
Industrial vendors assess PHP2Shell; several OT products affected
Unauthenticated PHP RCE flaws drew millions of attempts, with the first confirmed attacks aimed at honeypots.
82
Critical PHP2Shell flaws patched in PHP; PAN-OS still unfixed
CVE-2026-109618 and CVE-2026-109619 are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Palo Alto has no PAN-OS fix yet.
76
Palo Alto says PHP RCE flaws affect PAN-OS; hotfixes still pending
CVE-2026-109618 and CVE-2026-109619 hit several PAN-OS branches via management interfaces; Palo Alto reports no attacks on its products.
74
k0t exploits edge firewalls and VPNs, exposing over 70,000 credentials
Group-IB and NyxLab say k0t used FortiWeb and PAN-OS flaws, then remote-access tools and cloud exfiltration, from February to June 2026.
78
PAN-OS and Panorama affected by unpatched PHP2Shell flaws
Palo Alto has no fixed PAN-OS builds yet; Fortinet is still checking 12 products and Cisco 31 products and services.
74
Operators hit FortiGate, FortiWeb and GlobalProtect to steal stored passwords
Group-IB and NyxLab tie the edge-device campaign to k0t and report more than 70,000 exposed credentials.
78
Ransomware groups exploit Palo Alto GlobalProtect flaw CVE-2026-0257
Unit 42 has investigated intrusions since early June; Qilin, Inc, and Settra are among the operators named.
84
Ransomware groups exploit Palo Alto PAN-OS bug CVE-2026-0257
Unit 42 says Qilin, Inc and others use the GlobalProtect flaw for unauthorized VPN access, then ransomware, across many industries.
84
Qilin and INC exploit patched Palo Alto VPN bypass (CVE-2026-0257)
Unit 42 says the groups still use the May 2026 PAN-OS and Prisma Access fix to open unauthorized VPNs.
78
Qilin and INC exploit patched PAN-OS flaw to bypass MFA
Unit 42 says CVE-2026-0257 yields unauthorized VPN sessions, followed by RDP, SMB, and ransomware staging.
82
Ransomware groups exploit PAN-OS flaw CVE-2026-0257 to bypass MFA
Unit 42 says the GlobalProtect cookie bug yielded VPN access and later ransomware across several sectors since early June 2026.
82
Ransomware groups exploit GlobalProtect MFA bypass CVE-2026-0257
Unit 42 says attackers forged authentication-override cookies, then pulled domain credentials from a VMware virtual disk offline.
84
Qilin and Inc exploit PAN-OS GlobalProtect bypass CVE-2026-0257
Unit 42 says operators bypass MFA for VPN access, then move via RDP and SMB toward ransomware.
88
CISA Warns of Palo Alto Networks PAN-OS Code Injection Vulnerability Exploited in Attacks
CISA added PAN-OS code injection flaw CVE-2026-0322 to the KEV catalog after real-world attacks; federal agencies must mitigate by October 17.
80
U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Palo Alto PAN-OS, Cisco email gateway, and AhsayCBS flaws to the KEV catalog.
88
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Qilin and Settra are exploiting PAN-OS GlobalProtect flaw CVE-2026-0257, alongside new RATs and a DNS wallet drainer.
86
Palo Alto Warns of PAN-OS 0-day Flaw Actively Exploited in Attacks
Palo Alto says attackers are exploiting CVE-2026-0322, an authenticated PAN-OS management RCE that yields root.
84
Palo Alto Networks (PAN-OS) Remote Code Execution Vulnerability Exploited in Attack (CVE-2026-0322)
Attackers are exploiting CVE-2026-0322, an authenticated PAN-OS flaw that enables root code execution.
80
Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix
Attackers are exploiting PAN-OS CVE-2026-0322 for root access; CISA set a three-day fix.
82
Cisco Secure Email & PAN-OS Zero-Days Exploited
Cisco and Palo Alto patched two actively exploited zero-days enabling root code execution on email and PAN-OS appliances.
87
CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products
CISA added exploited Palo Alto, Cisco, and Ahsay flaws to KEV, with a three-day federal deadline.
90
Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
Palo Alto patched PAN-OS zero-day CVE-2026-0322 after limited exploitation for root remote code execution.
84
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto patches exploited PAN-OS management RCE CVE-2026-0322; CISA set an October 17 deadline.
82
Hackers Exploit Palo Alto PAN-OS 0-day Flaw to Gain Root Code Execution on Firewalls
Attackers are exploiting PAN-OS CVE-2026-0322 for limited root code execution through the management interface.
78
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
Palo Alto says attackers are exploiting PAN-OS RCE CVE-2026-0322, which CISA added to KEV.
84
Palo Alto Networks security advisory (AV26-1041)
Canada’s Cyber Centre urges patches for PAN-OS and Prisma Browser, including authenticated RCE CVE-2026-0322.
58
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited flaws in PAN-OS, Cisco Secure Email Gateway, and AhsayCBS to KEV.
82
CISA adds authenticated PAN-OS root RCE to KEV (CVE-2026-0322)
An authenticated attacker on the management network can run code as root on PA-Series, VM-Series, and Panorama; agencies must act by October 17.
76
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
Qilin and Settra are still exploiting Palo Alto CVE-2026-0257 to open unauthorized VPN sessions.
78
Related CVEs
by mentions- CVE-2026-03222%8.6Authenticated root RCE in Palo Alto PAN-OS management
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-025795%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-4630016%7.8Shared-frag marker loss in Linux kernel skb coalescing (LPE)
- CVE-2026-765192%9.8Relative Path Traversal to Root RCE in Cisco Secure Email Gateway
- CVE-2023-2753281%7.5Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials
- CVE-2026-10513482%10.0Unauthenticated OS Command Injection in AhsayCBS
- CVE-2026-10513379%6.9Improper authentication in Ahsay AhsayCBS API
- Buffer Overflow in PAN-OS XML Processing Enables Root RCE on PA-Series Firewalls
Appears with
- Palo Alto Networksvendor · 46
- CISAorganization · 21
- Panoramaproduct · 15
- Prisma Accessproduct · 15
- Unit 42organization · 14
- GlobalProtectproduct · 13
- Palo Alto Networksorganization · 12
- PA-Seriesproduct · 11
- VM-Seriesproduct · 11
- Qilinthreat actor · 11
- Ciscovendor · 8
- Cloud NGFWproduct · 7
- PHPproduct · 7
- ReliaQuestorganization · 6
- Cisco Secure Email Gatewayproduct · 6
- Settrathreat actor · 6
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.