Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

Attackers chain PHP2Shell with a kernel bug to root PAN-OS systems

14 sources · 26 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CISA lists PHP2Shell and Fragnesia as exploited; Palo Alto says exposed management interfaces were rooted, with federal deadlines this week.

PHP2Shell, CVE-2026-109618 and CVE-2026-109619, are critical PHP flaws that allow unauthenticated remote code execution. PHP patched supported branches on October 21 in 8.2.35, 8.3.36, 8.4.27, and 8.5.12; CISA added both to the KEV catalog on October 26, with a federal deadline of October 29. Attackers chained them with Linux kernel flaw Fragnesia, CVE-2026-46300, added to KEV on October 28 with an October 31 deadline. Palo Alto Networks and Unit 42 say the chain rooted internet-exposed PAN-OS management systems. Dream reports 25 servers in the US, Japan, Taiwan, and South Korea, including a US government-affiliated environment, and suspects China-nexus operators; further identity-theft success is unconfirmed. SecurityWeek describes a pool of hundreds, while Dream and Infosecurity cite about 19,000 exposed devices and 240 targets.

Key facts
  • Fixed PHP builds are 8.2.35, 8.3.36, 8.4.27, and 8.5.12; older branches are unsupported.
  • PAN-OS hotfixes include 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4, and 10.2.18-h13.
  • Palo Alto says about 0.02% of its installed base had exposed management interfaces.
  • GlobalProtect, Clientless VPN, and Captive Portal are not affected.
  • Unit 42 counted over 22.6 million potentially exposed PHP instances, not confirmed firewall breaches.
  • Kernel fixes include 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, and 7.0.10.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Aug 19, 2026Wiz found the first PHP2Shell flaw. · Cyber Security News
  2. Oct 21, 2026PHP released fixes for supported branches. · The Hacker News
  3. Oct 23, 2026Attackers compromised government-linked systems, Dream says. · The Hacker News
  4. Oct 26, 2026CISA added both PHP2Shell flaws to KEV. · Cyber Security News
  5. Oct 28, 2026CISA added Fragnesia CVE-2026-46300 to KEV. · Cyber Security News
  6. Oct 29, 2026Unit 42 verified tools chaining the kernel bug for root. · Cyber Security News

What each outlet adds

beyond the shared facts
  • The Hacker NewsDream’s country list, reverse SSH activity, and suspected China-nexus AI-assisted tooling.
  • BleepingComputerPublic Fragnesia proof of concept for kernels released before May 13, 2026.
  • Infosecurity MagazineTwenty-two hosts only got webshells; Active Directory theft remains unconfirmed.
  • SecurityWeekDefiant saw no WordPress compromise; Cato and WatchTowr attack telemetry.
  • Cyber Security NewsFixed Linux versions, CVSS 7.8, and the October 31 federal kernel deadline.
CVEs
CVE-2026-109618CVE-2026-109619CVE-2026-46300CVE-2026-115560
Vendors
Palo Alto NetworksPHP FoundationPHPPHP Group
Products
PAN-OSPanoramaPHPWordPressLinux kernelPA-SeriesVM-SeriesClaude CodeLinux
Victims
U.S. government-affiliated organization
Organizations
DreamUnit 42DefiantCato NetworksWatchTowrCISADream SecurityDream ResearchOffSecWizAmazonPHP Foundation
Countries
ChinaUnited StatesJapanTaiwanSouth Korea
AI models
DeepSeekKimi

Coverage

oldest first · one row per article · UTC
  1. · 2d ago Cyber Security NewsFirst report

    CISA says PHP2Shell flaws are exploited for remote code execution

    Federal civilian agencies must mitigate CVE-2026-109618 and CVE-2026-109619 or remove affected products by October 29.

  2. · 2d ago ESET WeLiveSecurity

    ESET reviews a week of PHP, kernel, and LiteLLM incidents

    PHP fixes shipped October 21; nine firms, including ESET, told NBC News they had seen no successful PHP2Shell attacks.

  3. · 2d ago SecurityWeek

    China-linked hackers root firewalls via PHP2Shell and Fragnesia

    Dream says attackers exploited 25 of 19,000 internet-facing firewalls on October 23-24 and planted root webshells on 24.

  4. · 2d ago The Hacker News

    PHP2Shell campaign roots 25 servers, including U.S. government-linked hosts

    Dream says a custom exploit plus a Linux kernel bug rooted firewalls in the U.S., Japan, Taiwan, and South Korea.

  5. · 2d ago Cyber Security News

    PHP2Shell flaws exploited in the wild; OffSec ships free lab

    CISA listed both flaws on October 26; fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

  6. · 2d ago GBHackers

    PHP2Shell flaws exploited in the wild; OffSec ships free lab

    CISA listed both flaws on October 26; fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

  7. · 2d ago Wordfence

    Wordfence sees no confirmed WordPress compromises from PHP2Shell

    From October 23 to 27 Wordfence logged about 77,600 PHP2Shell requests from more than 2,000 IPs and still urges a PHP update plus restart.

  8. · 1d ago Cyber Security News

    Attackers chain PHP2Shell and kernel exploits for root on 25 servers

    Dream says custom exploits for CVE-2026-109618, CVE-2026-109619 and CVE-2026-46300 reached government-affiliated firewalls and Active Directory.

  9. · 1d ago GBHackers

    Attackers chain PHP2Shell flaws to root 25 firewall servers

    Dream says the chain, including kernel flaw CVE-2026-46300, rooted devices in the US, Japan, Taiwan, and South Korea in under 15 minutes.

  10. · 1d ago The Hacker News

    PHP2Shell flaws exploited on exposed Palo Alto management interfaces

    Unauthenticated RCE hits internet-facing PAN-OS management; CISA set an October 31 deadline for kernel bug CVE-2026-46300.

  11. · 1d ago CSO Online

    CISA confirms active exploitation of PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619

    Official fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while many appliance and EOL runtimes have no direct patch.

  12. · 1d ago Hacker News · security

    Chained PHP2Shell exploit roots 25 firewalls, including US government systems

    Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.

  13. · 1d ago BleepingComputer

    CISA warns Fragnesia Linux flaw is chained in PHP2Shell attacks

    Agencies must patch CVE-2026-46300 by Saturday 10; researchers say the chain rooted 25 servers, including three US government-affiliated hosts.

  14. · 1d ago The Register · Security

    Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain

    The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.

  15. · 1d ago The Record

    Reports say PHP2Shell bugs were exploited, including on firewalls

    GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.

  16. · 20h ago CSO Online

    Attackers chain PHP2Shell with Fragnesia kernel bug for root

    Dream Security says the chain rooted Palo Alto firewalls and reached Active Directory on 25 servers, three tied to the US government.

  17. · 20h ago Tenable Blog

    php2shell RCE confirmed on honeypots and some network appliances

    Public PoCs often fail unless tuned to one PHP build, but shared appliance images let one exploit hit many devices.

  18. · 17h ago Cyber Security News

    CISA says attackers exploit Linux kernel flaw CVE-2026-46300

    Federal agencies face an October 31 deadline; CISA says the bug is chained to plant PHP webshells and run as root.

  19. · 14h ago The Hacker News

    Drupal Commerce Core authorization bypass actively exploited

    CVE-2026-118539 affects Commerce Core 0.0.0–2.41 and 3.0.0–3.3.13; Drupal says to upgrade to 8.x-2.41 or 3.3.13.

  20. · 11h ago BleepingComputer

    Drupal Commerce Core access bypass exploited in attacks

    Unauthenticated attackers can bypass route and field protections on more than 42,000 sites and may cause financial loss.

  21. · 11h ago Cyber Security News

    Palo Alto confirms PHP2Shell attacks on exposed PAN-OS management

    Unit 42 verified tools that pair the PHP flaws with kernel bug CVE-2026-46300 for root; about 0.02% of the installed base was exposed.

  22. · 10h ago SecurityWeek

    Drupal Commerce Core access bypass exploited against online stores

    Unauthenticated attackers can hit the flaw on more than 42,000 sites; fixed releases are 3.3.13 and 8.x-2.41.

  23. · 9h ago Infosecurity Magazine

    Suspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell

    The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.

  24. · 7h ago Cyber Security News

    Drupal Commerce access bypass exploited in the wild (CVE-2026-118539)

    Unauthenticated attackers can reach protected routes and fields; sites should update and audit orders.

  25. · 6h ago SecurityWeek

    PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared

    A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.

  26. · 6h ago Canadian Centre for Cyber Security

    Drupal Commerce Core access bypass reported exploited in the wild

    Releases before 2.41 and 3.0.0 before 3.3.13 are affected; Drupal rates the issue highly critical.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV
CVE-2026-115560
——PoC ×11—
CVE-2026-46300
Shared-frag marker loss in Linux kernel skb coalescing (LPE)
7.816%KEVPoC
KEV