Attackers chain PHP2Shell flaws to root Palo Alto PAN-OS firewalls
Hunt.io says 24 perimeter firewalls and one internal management server were compromised, including a US government-affiliated environment.
84
- Mentions · 7d47
- Mentions · 30d116
- All mentions120
- First seenAug 16, 2026
- Last mentioned1h ago
Timeline
120 articles · newest firstJapan reports a wave of AI-assisted attacks on firms and agencies
Officials cite data on about 260 million people since April, while leak reports rose from 303 in September to 830 in October.
72
PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
88
Palo Alto confirms PHP2Shell attacks on exposed PAN-OS management
Unit 42 verified tools that pair the PHP flaws with kernel bug CVE-2026-46300 for root; about 0.02% of the installed base was exposed.
86
Drupal Commerce Core authorization bypass actively exploited
CVE-2026-118539 affects Commerce Core 0.0.0–2.41 and 3.0.0–3.3.13; Drupal says to upgrade to 8.x-2.41 or 3.3.13.
74
Attackers chain PHP2Shell with Fragnesia kernel bug for root
Dream Security says the chain rooted Palo Alto firewalls and reached Active Directory on 25 servers, three tied to the US government.
84
Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
84
Checkmarx says PHP patch rush shows remediation bottlenecks
A PHP advisory requires a runtime update because the attack path can run before application code.
24
CISA warns Fragnesia Linux flaw is chained in PHP2Shell attacks
Agencies must patch CVE-2026-46300 by Saturday 10; researchers say the chain rooted 25 servers, including three US government-affiliated hosts.
88
Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
78
PHP2Shell flaws exploited on exposed Palo Alto management interfaces
Unauthenticated RCE hits internet-facing PAN-OS management; CISA set an October 31 deadline for kernel bug CVE-2026-46300.
88
Wiz CTO discusses PHP critical-bug cleanup on Equity podcast
Schwartz says he joined OpenAI, Calif and the PHP team after two critical bugs forced some sites offline.
30
Wiz CTO says PHP cleanup continues after critical bugs
Schwartz says AI tooling found bugs that sat in PHP for more than a decade, and some sites are still unpatched.
32
Wordfence sees no confirmed WordPress compromises from PHP2Shell
From October 23 to 27 Wordfence logged about 77,600 PHP2Shell requests from more than 2,000 IPs and still urges a PHP update plus restart.
74
PHP2Shell campaign roots 25 servers, including U.S. government-linked hosts
Dream says a custom exploit plus a Linux kernel bug rooted firewalls in the U.S., Japan, Taiwan, and South Korea.
86
China-linked hackers root firewalls via PHP2Shell and Fragnesia
Dream says attackers exploited 25 of 19,000 internet-facing firewalls on October 23-24 and planted root webshells on 24.
80
CISA adds exploited Brotli and Adobe Commerce flaws to KEV
Federal agencies must fix CVE-2026-111497 and CVE-2026-48356 by October 29, 2026, after reported exploit traffic and store infections.
86
CISA adds exploited Adobe Commerce and Brotli flaws to KEV
PolyShell has hit hundreds of stores since at least July 2025; Brotli exploit traffic is also being seen.
86
Blog argues rapid disclosures leave defenders unable to keep up
A week of KVM, PHP, CA, and Brotli issues shows fixes arrive faster than inventory, assessment, and rollout.
28
OpenAI says AI bug reports are overwhelming open-source maintainers
Daybreak has developed 661 tested patches, of which maintainers accepted 458, and OpenAI urges quality and coordinated disclosure.
36
PHP2Shell attempts preceded same-week patches for PHP, GitLab and Node.js
GitLab’s unauthenticated RCE is CVSS 10.0 back to version 7.0; LiteLLM 1.107.0 stole credentials and OpenCode keys may have leaked.
84
Wiz reports limited PHP2Shell exploitation attempts after disclosure
Internet-exposed vulnerable machines fell about 67 percent, and captured attempts did not finish a general exploit chain.
78
CISA orders agencies to patch two targeted PHP bugs by Thursday
CVE-2026-109618 and CVE-2026-109619 drew thousands of failed attempts; confirmed successful exploitation remains unproven.
86
Cloudflare opens PHP CTF for php2shell WAF bypasses
HackerOne participants must get code execution on PHP 8.5.11, read a resetting flag, and privately report a distinct bypass.
52
PHP2Shell weaponized after Japanese real estate extortion
The captured page calls PHP2Shell PHP core remote code execution and promotes a version checker.
48
Malwarebytes warns of ClickFix lures amid PHP, Brotli and certificate issues
The piece says attackers exploited two unnamed PHP flaws and that browsers have blocked eight bad certificates.
28
Hunt says predicted PHP2Shell cybergeddon did not occur
He says it took days to find one breach reliably tied to PHP2Shell, despite many unmaintained sites.
28
PHP CGI pointer underflow allows unauthenticated RCE (CVE-2026-109618)
Default cgi.fix_pathinfo exposes PHP 5.x through 8.4.26; only the 8.2 and later branches are scheduled to be fixed.
74
CISA confirms active exploitation of two PHP2Shell RCE flaws
Both flaws score CVSS 9.2; fixes shipped October 21, and US agencies must patch by October 29.
90
Google Brotli decoder CVE-2026-111497 can yield remote code execution
Google scored it 9.2; major runtimes have fixes, but some projects had not shipped a fixed release as of October 26.
76
Leftover PHP on a ColdFusion IIS server broke sign-in during mitigation
A host-wide IIS rule blocked every multipart form, not just .php requests, until the author narrowed it.
24
Sansec: 953 online stores, mostly Magento, hit by scanner-evading JavaScript
Loaders in Magento CMS blocks fetch follow-on code only for real shoppers; the final payload is still unknown.
72
UK pentester claims $2,000 Bitcoin prize for PHP2Shell CTF RCE
Jaydip Modhwadia says he achieved remote code execution in about three hours after a PHP endpoint was added.
52
Check Point weekly brief covers Onamae intrusion, PHP exploits, GitLab RCE
The October 26 bulletin also flags an exploited Arista flaw, a LiteLLM package compromise, and the Aokigahara infostealer.
66
Industrial vendors assess PHP2Shell; several OT products affected
Unauthenticated PHP RCE flaws drew millions of attempts, with the first confirmed attacks aimed at honeypots.
82
Weekly recap: PHP2Shell scans, Plex2Shell attacks, LiteLLM supply chain
CISA listed four exploited Plex flaws, while a leaked LiteLLM key led to a malicious Python package release.
78
Critical PHP flaws dubbed PHP2Shell allow unauthenticated code execution
Early exploit attempts followed disclosure, and some sites went offline while owners applied patches.
86
PHP2Shell patches are out; exploit attempts seen, no confirmed hits
Memory-safety flaws in PHP back to about 5.4 can yield remote code execution, and some sites cannot patch in place.
40
CISA KEV lists PHP memory-corruption flaw enabling unauthenticated RCE
CVE-2026-109618 is an out-of-memory corruption bug; federal due date is October 29, and ransomware use is unknown.
88
CISA KEV lists PHP request-state flaw enabling unauthenticated RCE
CVE-2026-109619 is a stale internal request-state bug; the federal remediation due date is October 29.
88
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-4630016%7.8Shared-frag marker loss in Linux kernel skb coalescing (LPE)
- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2026-4835645%9.3Unrestricted dangerous file upload in Adobe Commerce and Magento
- CVE-2026-1102641%10.0Unauthenticated RCE in GitLab CE/EE via regex integer overflow
- CVE-2026-7260<1%5.4Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.*…
- CVE-2026-1146251%9.4SQL injection in Arista VeloCloud Orchestrator grants superuser
- CVE-2026-91766<1%5.9PHP HTTP Stream Wrapper Leaks Credentials on Redirects
Appears with
- Wizorganization · 27
- Cloudflareorganization · 21
- OpenAIorganization · 21
- CISAorganization · 16
- PHP Foundationorganization · 15
- WordPressproduct · 15
- PHP Foundationvendor · 15
- PHP Groupvendor · 11
- Califorganization · 11
- Node.jsproduct · 10
- Palo Alto Networksvendor · 10
- Drupalproduct · 8
- GPT-5.6 Solai model · 8
- watchTowrorganization · 7
- CERT-EUorganization · 7
- PAN-OSproduct · 7
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.