PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
88
Product
WordPress
- Mentions · 7d13
- Mentions · 30d72
- All mentions168
- First seenAug 12, 2026
- Last mentioned9h ago
Timeline
168 articles · newest firstStock WordPress pingback can crash workers via Brotli CVE-2026-111497
WordPress does not ship Brotli, but libcurl unpacks attacker-supplied br replies before WordPress sees them.
82
Wordfence July 2026 bounty program received 1,077 reports
Validated WordPress plugin and theme flaws are disclosed to vendors and can get firewall coverage.
18
ThreatsDay: Fortinet fixes, PHP2Shell scans, Authenticator token flaw
Fortinet is withholding flaw details until November 10 while Hudson Rock reports 40,573 exposed FortiGate secrets.
64
Wordfence logs 268 WordPress flaws, 43 still unpatched
Of the week’s disclosures, 7 were critical and 69 high, spanning 182 plugins and 15 themes.
36
Wiz CTO says PHP cleanup continues after critical bugs
Schwartz says AI tooling found bugs that sat in PHP for more than a decade, and some sites are still unpatched.
32
Wordfence sees no confirmed WordPress compromises from PHP2Shell
From October 23 to 27 Wordfence logged about 77,600 PHP2Shell requests from more than 2,000 IPs and still urges a PHP update plus restart.
74
AfD breach exposes 345,000 email addresses and messages
Have I Been Pwned added the September leak on October 27 as a sensitive breach, so only verified owners can search it.
72
Malwarebytes warns of ClickFix lures amid PHP, Brotli and certificate issues
The piece says attackers exploited two unnamed PHP flaws and that browsers have blocked eight bad certificates.
28
Logged-in WordPress admins tricked into installing hidden PHP backdoors
Securonix calls the chain TRUST#GRAFT; a fake Cloudflare screen uploads wm.zip and hides it as a must-use plugin.
66
TRUST#GRAFT uses logged-in WordPress admins to install a PHP backdoor
The chain uploads wm.zip as Web Media Optimizer and copies itself to mu-plugins so deleting the visible plugin leaves it loaded.
62
Equity podcast debates PHP flaws, disclosure panic and attack attempts
Cloudflare's CEO is cited as seeing PHP2Shell attack attempts climb into the millions after an embargo broke.
36
PHP Foundation patches two critical unauthenticated RCE bugs, PHP2Shell
Calif's proof-of-concept shows unauthenticated remote code execution; mass exploitation is described as avoided so far.
78
Unit 42: BUGSTER used DeepSeek V4 in India university data theft
The actor brute-forced a site and stole more than 5,200 student and faculty PII records, Unit 42 says.
64
PHP2Shell flaws can give unauthenticated control of website servers
Calif and Wiz found the bugs; OpenAI helped PHP develop patches, and the NSA urged taking unpatched systems offline.
90
Critical PHP flaws prompt site shutdowns as exploit attempts surge
watchTowr says both bugs are remote code execution from PHP 5 onward and were rated 9.2 of 10.
90
Searchlight releases php2shell-scanner for two PHP RCE bugs
The open-source scanner forces a PHP out-of-memory condition instead of trusting version banners.
62
Core PHP PHP2Shell bugs enable unauthenticated RCE, two teams report
Calif, using GPT-5.6 Sol, and Wiz independently found CVE-2026-109618 and CVE-2026-109619 after about two months of private coordination.
90
PHP emergency updates fix two unauthenticated RCE flaws, CVSS 9.2
Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; updating WordPress does not update PHP.
86
NSA warns of two critical PHP flaws present since version 5
OpenAI and Wiz say the holes were found before attackers; unpatched sites should go offline, and PHP 8.5.12 is recommended.
82
Notebook counts 421,178 messages in AfD email leak
The hexane archive also holds WordPress databases for afd.de and about 140 other party sites.
64
PHP2Shell flaws draw early attacks; emergency PHP updates out
Fixes are in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; both bugs are rated 9.2.
92
Talos tracks two unauthenticated PHP core RCEs called php2shell
Talos had not seen exploitation as of October 21 and says about half of PHP systems may never be patched.
84
PHP releases emergency fixes for two critical unauthenticated RCEs
Exploits are public, and Finnish and Dutch sites went offline while watchTowr says attempts have not succeeded.
86
Calif Research shows pre-auth PHP2Shell RCE on default PHP
The authors say paths dating to PHP 5.4.0 yield RCE, including on WordPress, Drupal, and Joomla.
82
BUGSTER used jailbroken AI to hit Indian universities, Unit 42 says
The actor dumped more than 5,200 student records and planned VoIP fraud, Wi-Fi cracking, and crypto reconnaissance.
72
PHP rushes emergency patches as early php2shell attacks reported
Cloudflare says early attacks are emerging and has pushed temporary firewall rules to all customers, including free accounts.
90
Wiz details PHP2Shell RCEs in core PHP back to 5.4
Unauthenticated attackers can run code or read worker memory that may hold passwords, tokens and keys; PHP patched on October 21, 2026.
86
Critical PHP remote code execution flaw already under attack
Patchstack says the only current fix is upgrading PHP, with an update scheduled for October 21 at 14:00 UTC.
90
Stolen UpdraftCentral keys used to backdoor WordPress sites
TeamUpdraft says a weekend breach exposed remote-management keys; Patchstack logged backdoor plugins on connected sites.
76
PHP schedules critical security release for October 21
Two flaws are each rated CVSS v4.0 9.2, but versions, fixes and CVE identifiers remain unpublished.
78
HTTP 401 means the server rejected unproven credentials
Sucuri covers WordPress, server, and API causes, and when a sudden wave of 401s can indicate compromise.
18
Trojanized Rank Math PRO 3.0.123 planted website backdoors
Only downloads from a roughly 11-hour window were affected; the vendor shipped clean version 3.0.124.
74
Stolen UpdraftCentral keys used to backdoor WordPress sites
Signed commands installed backdoor plugins from October 18 to 19; no plugin update stops it, so sites must delete UpdraftCentral keys.
78
Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication
Seqrite details WP2Shell, an unauthenticated WordPress chain combining two core flaws into remote code execution.
78
PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads
Some Rank Math SEO PRO 3.0.123 downloads included malware that can backdoor WordPress sites and steal credentials.
80
Hackers Abuse 20,000 Cloudflare Pages Domains to Push Fake Microsoft Security Alerts
Attackers used over 20,000 Cloudflare Pages domains to push fake Microsoft alerts into tech-support scams.
74
Researchers Uncover 20,000 Malicious Cloudflare Pages Domains Used in Tech Support Scams
Infoblox found over 20,000 Cloudflare Pages domains used by Help TDS for Microsoft tech-support scams.
62
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)
Wordfence logged 655 WordPress plugin and theme flaws last week, including core XSS and unauthenticated SQL injection.
58
600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin
Backuply through version 1.5.8 lets subscribers plant SQL that becomes administrator access on restore.
64
Related CVEs
by mentions- CVE-2026-8790296%8.1Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2)
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-6303011%9.8WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
- CVE-2026-601375%5.9WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)
- CVE-2026-850973%9.8Unauthenticated file upload to RCE in WordPress Bricksforge
- CVE-2026-6000424%9.8Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection
- CVE-2026-72733%8.8Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- CVE-2026-324752%9.0Unauthenticated PHP File Upload (RCE) in Elementor Pro WordPress Plugin
- CVE-2026-94504<1%7.2Stored XSS in Ninja Forms 3.15.3 Legacy Submission Editor
Appears with
- WordPressvendor · 42
- Patchstackorganization · 29
- Wordfenceorganization · 24
- Wordfencevendor · 20
- PHPproduct · 15
- Patchstackvendor · 14
- WordPressorganization · 13
- Drupalproduct · 12
- Cloudflarevendor · 12
- Microsoftvendor · 12
- OpenAIorganization · 10
- Automatticvendor · 10
- Joomlaproduct · 9
- WooCommerceproduct · 9
- Elementorvendor · 8
- Wizorganization · 8
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.