PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
88
Product
Panorama
- Mentions · 7d4
- Mentions · 30d15
- All mentions18
- First seenAug 17, 2026
- Last mentioned9h ago
Timeline
18 articles · newest firstPalo Alto confirms PHP2Shell attacks on exposed PAN-OS management
Unit 42 verified tools that pair the PHP flaws with kernel bug CVE-2026-46300 for root; about 0.02% of the installed base was exposed.
86
Critical PHP2Shell flaws patched in PHP; PAN-OS still unfixed
CVE-2026-109618 and CVE-2026-109619 are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Palo Alto has no PAN-OS fix yet.
76
Palo Alto says PHP RCE flaws affect PAN-OS; hotfixes still pending
CVE-2026-109618 and CVE-2026-109619 hit several PAN-OS branches via management interfaces; Palo Alto reports no attacks on its products.
74
PAN-OS and Panorama affected by unpatched PHP2Shell flaws
Palo Alto has no fixed PAN-OS builds yet; Fortinet is still checking 12 products and Cisco 31 products and services.
74
CISA Warns of Palo Alto Networks PAN-OS Code Injection Vulnerability Exploited in Attacks
CISA added PAN-OS code injection flaw CVE-2026-0322 to the KEV catalog after real-world attacks; federal agencies must mitigate by October 17.
80
U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Palo Alto PAN-OS, Cisco email gateway, and AhsayCBS flaws to the KEV catalog.
88
Palo Alto Warns of PAN-OS 0-day Flaw Actively Exploited in Attacks
Palo Alto says attackers are exploiting CVE-2026-0322, an authenticated PAN-OS management RCE that yields root.
84
Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix
Attackers are exploiting PAN-OS CVE-2026-0322 for root access; CISA set a three-day fix.
82
CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products
CISA added exploited Palo Alto, Cisco, and Ahsay flaws to KEV, with a three-day federal deadline.
90
Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
Palo Alto patched PAN-OS zero-day CVE-2026-0322 after limited exploitation for root remote code execution.
84
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto patches exploited PAN-OS management RCE CVE-2026-0322; CISA set an October 17 deadline.
82
Hackers Exploit Palo Alto PAN-OS 0-day Flaw to Gain Root Code Execution on Firewalls
Attackers are exploiting PAN-OS CVE-2026-0322 for limited root code execution through the management interface.
78
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
Palo Alto says attackers are exploiting PAN-OS RCE CVE-2026-0322, which CISA added to KEV.
84
CISA adds authenticated PAN-OS root RCE to KEV (CVE-2026-0322)
An authenticated attacker on the management network can run code as root on PA-Series, VM-Series, and Panorama; agencies must act by October 17.
76
PANORAMA: Panoptic Grounded Captioning via Mask Proposal Selection
PANORAMA grounds vision-language caption phrases in pixel-level masks via mask proposal selection, achieving state-of-the-art grounding on the new PanoCaps benchmark.
25
PANORAMA: Panoptic Grounded Captioning via Mask Proposal Selection
Researchers introduce PANORAMA, a vision-language model grounding caption phrases in pixel masks, alongside the PanoCaps benchmark and gPQ metric.
42
Best Practice Assessment Archives
Palo Alto Networks' Best Practice Assessment measures Next-Generation Firewall and Panorama configuration usage, enabling customers to strengthen security and maximize return on investment.
10
Related CVEs
by mentions- CVE-2026-03222%8.6Authenticated root RCE in Palo Alto PAN-OS management
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-765192%9.8Relative Path Traversal to Root RCE in Cisco Secure Email Gateway
- CVE-2026-10513482%10.0Unauthenticated OS Command Injection in AhsayCBS
- CVE-2026-10513379%6.9Improper authentication in Ahsay AhsayCBS API
- CVE-2025-010898%8.8Authentication Bypass in Palo Alto Networks PAN-OS Management Interface
- CVE-2026-4630016%7.8Shared-frag marker loss in Linux kernel skb coalescing (LPE)
Appears with
- Palo Alto Networksvendor · 16
- PAN-OSproduct · 15
- CISAorganization · 8
- Palo Alto Networksorganization · 8
- PA-Seriesproduct · 8
- VM-Seriesproduct · 8
- Ciscovendor · 4
- Prisma Accessproduct · 3
- Cloud NGFWproduct · 3
- Unit 42organization · 3
- Cisco Secure Email Gatewayproduct · 3
- PHPproduct · 3
- Ahsayvendor · 2
- PanoCapsproduct · 2
- Huntressorganization · 2
- AhsayCBSproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.