Attackers chain PHP2Shell flaws to root Palo Alto PAN-OS firewalls
Hunt.io says 24 perimeter firewalls and one internal management server were compromised, including a US government-affiliated environment.
84
Vendor
Palo Alto Networks
- Mentions · 7d25
- Mentions · 30d81
- All mentions280
- First seenAug 11, 2026
- Last mentioned17h ago
Timeline
280 articles · newest firstPHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
88
Suspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell
The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.
86
Palo Alto confirms PHP2Shell attacks on exposed PAN-OS management
Unit 42 verified tools that pair the PHP flaws with kernel bug CVE-2026-46300 for root; about 0.02% of the installed base was exposed.
86
Buyer’s guide compares 12 incident response retainer services
The review weighs SLAs, unused-hour conversion, onboarding and post-acquisition ownership rather than responder reputation alone.
24
Buyer's guide ranks 12 DFIR firms; Coveware now under Veeam
The guide matches firms to breach lanes and flags Coveware's acquisition by Veeam as a procurement issue.
22
2026 ranking puts Recorded Future first among CTI providers
Mandiant and CrowdStrike place second and third; Kaspersky is flagged as jurisdiction-gated for Western buyers.
17
php2shell RCE confirmed on honeypots and some network appliances
Public PoCs often fail unless tuned to one PHP build, but shared appliance images let one exploit hit many devices.
82
Attackers chain PHP2Shell with Fragnesia kernel bug for root
Dream Security says the chain rooted Palo Alto firewalls and reached Active Directory on 25 servers, three tied to the US government.
84
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
84
Warp Panda used VMware ESX zero-day; firewalls rooted and crashed
CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.
84
LevelBlue: vulnerability exploitation rose to 14% of initial access
The firm's Q1 figure was 20%, while Verizon's 2026 DBIR put exploitation behind 31% of breaches.
36
2026 buyer's guide ranks 12 cyber threat intelligence feeds
The unpaid comparison maps each provider to the question it answers best and flags Kaspersky for US and allied procurement bans.
22
2026 ranking puts Recorded Future first among threat intelligence platforms
Editorial scores, not lab tests, place Anomali second and open-source OpenCTI third.
22
2026 buyer’s guide ranks 12 SOAR platforms by team fit
The research-based guide splits tools into SIEM-bundled, playbook, no-code, and intel-led lanes and flags Revelstoke as absorbed.
18
2026 ranking puts Cortex XSOAR first among SOAR tools
Editorial scores, not lab results, place Splunk SOAR and Tines next, with Torq leading the agentic-AI lane.
16
2026 buyer’s guide compares 12 SIEM platforms
The guide stresses pricing fit and ownership changes, including QRadar’s split lanes and Splunk under Cisco.
17
PHP2Shell flaws exploited on exposed Palo Alto management interfaces
Unauthenticated RCE hits internet-facing PAN-OS management; CISA set an October 31 deadline for kernel bug CVE-2026-46300.
88
Volt Typhoon rebuilt Silent Train relay chains since late 2023
Black Lotus Labs says chains were rebuilt in under two minutes and hundreds of victims were notified.
84
Eclypsium report details exploited flaws in firewalls, VPNs and network appliances
InfraTrust tracked 133 new advisories covering 2,813 vulnerabilities in a month; 16 advisories involved actively exploited KEV-listed flaws.
90
CISA lists Brotli Node2Shell flaw as honeypots log attempts
CVE-2026-111497 hits Brotli 1.0.3 through 1.2.0; US civilian agencies must address it by November 10.
84
Horizon3 sends NodeZero findings into Palo Alto Cortex XSOAR
High and critical findings become XSOAR incidents, and 1-Click Verify retests whether a fix is still exploitable.
32
Palo Alto says Brotli flaw can hit some PAN-OS firewalls (CVE-2026-111497)
The CVSS 9.2 decoder bug needs Brotli inspection plus decryption; no exploitation is known, and hotfixes are only estimated.
64
Check Point weekly brief covers Onamae intrusion, PHP exploits, GitLab RCE
The October 26 bulletin also flags an exploited Arista flaw, a LiteLLM package compromise, and the Aokigahara infostealer.
66
Critical PHP2Shell flaws patched in PHP; PAN-OS still unfixed
CVE-2026-109618 and CVE-2026-109619 are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Palo Alto has no PAN-OS fix yet.
76
Palo Alto says PHP RCE flaws affect PAN-OS; hotfixes still pending
CVE-2026-109618 and CVE-2026-109619 hit several PAN-OS branches via management interfaces; Palo Alto reports no attacks on its products.
74
k0t exploits edge firewalls and VPNs, exposing over 70,000 credentials
Group-IB and NyxLab say k0t used FortiWeb and PAN-OS flaws, then remote-access tools and cloud exfiltration, from February to June 2026.
78
eMudhra Intermediate CA Private Keys Compromised
Eight eMudhra intermediate CA private keys generated with insufficient randomness were compromised, enabling private key derivation and unauthorized TLS certificate signing.
80
k0t steals credentials from FortiGate, FortiWeb and GlobalProtect
Group-IB reports more than 70,000 exposed credentials and active use of CVE-2025-64446 and CVE-2026-0257.
78
PAN-OS and Panorama affected by unpatched PHP2Shell flaws
Palo Alto has no fixed PAN-OS builds yet; Fortinet is still checking 12 products and Cisco 31 products and services.
74
Buyer’s guide compares 12 DevSecOps platforms for 2026
The roundup judges GitHub, GitLab, JFrog, Snyk, and others on scanning depth, workflow fit, and pricing.
18
October 21 fixes cover PHP2Shell, LiteLLM theft, and VPN attacks
Fixed PHP builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; LiteLLM 1.107.0 stole secrets, so pin 1.106.2 and rotate them.
86
Operators hit FortiGate, FortiWeb and GlobalProtect to steal stored passwords
Group-IB and NyxLab tie the edge-device campaign to k0t and report more than 70,000 exposed credentials.
78
Unit 42 warns of two critical PHP RCE flaws scored 9.2
Unit 42 says it has seen proof-of-concept code and telemetry showing over 22.6 million potentially exposed instances.
78
Ransomware groups exploit Palo Alto GlobalProtect flaw CVE-2026-0257
Unit 42 has investigated intrusions since early June; Qilin, Inc, and Settra are among the operators named.
84
Ransomware groups exploit Palo Alto PAN-OS bug CVE-2026-0257
Unit 42 says Qilin, Inc and others use the GlobalProtect flaw for unauthorized VPN access, then ransomware, across many industries.
84
Qilin and INC exploit patched Palo Alto VPN bypass (CVE-2026-0257)
Unit 42 says the groups still use the May 2026 PAN-OS and Prisma Access fix to open unauthorized VPNs.
78
Qilin and INC exploit patched PAN-OS flaw to bypass MFA
Unit 42 says CVE-2026-0257 yields unauthorized VPN sessions, followed by RDP, SMB, and ransomware staging.
82
Ransomware groups exploit PAN-OS flaw CVE-2026-0257 to bypass MFA
Unit 42 says the GlobalProtect cookie bug yielded VPN access and later ransomware across several sectors since early June 2026.
82
Ransomware groups exploit GlobalProtect MFA bypass CVE-2026-0257
Unit 42 says attackers forged authentication-override cookies, then pulled domain credentials from a VMware virtual disk offline.
84
Related CVEs
by mentions- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-025795%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-03222%8.6Authenticated root RCE in Palo Alto PAN-OS management
- CVE-2026-4630016%7.8Shared-frag marker loss in Linux kernel skb coalescing (LPE)
- CVE-2026-765192%9.8Relative Path Traversal to Root RCE in Cisco Secure Email Gateway
- CVE-2023-2753281%7.5Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials
- CVE-2026-10513482%10.0Unauthenticated OS Command Injection in AhsayCBS
- CVE-2025-6444691%9.8Unauthenticated Path Traversal in Fortinet FortiWeb Enables Admin Command Execution
- CVE-2026-6389<1%7.8IBM Turbonomic prometurbo agent 8.16.0 through 8.17.6 IBM Turbonomic Application Resource Management grants excessive cluster‑wide permissions, including…
Appears with
- Unit 42organization · 97
- Palo Alto Networksorganization · 86
- PAN-OSproduct · 46
- Microsoftvendor · 46
- CrowdStrikevendor · 38
- Unit 42vendor · 33
- Googlevendor · 27
- CISAorganization · 26
- Wizvendor · 25
- Prisma Cloudproduct · 25
- Fortinetvendor · 24
- Ciscovendor · 23
- Cortex XDRproduct · 20
- Prisma Accessproduct · 19
- GlobalProtectproduct · 18
- Sysdigvendor · 16
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.