Chinese Actors Chain PHP2Shell to Root Palo Alto Firewalls
First merged summary.
Suspected Chinese actors chained PHP2Shell RCE flaws with Fragnesia kernel bug to root 25 PAN-OS firewalls in the US, Japan, Taiwan, and South Korea.
Suspected Chinese nation-state actors chained unauthenticated RCE vulnerabilities in PHP2Shell (CVE-2026-109618 and CVE-2026-109619) with the Fragnesia Linux kernel flaw (CVE-2026-46300) to gain root access on internet-exposed Palo Alto Networks PAN-OS management interfaces. The attacks targeted around 240 out of 19,000 exposed devices across the US, Japan, Taiwan, and South Korea, compromising 25 servers between October 23 and 24. Three of the affected systems were in US government-affiliated environments. CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by October 31 under BOD 26-04. Unit 42 verified the exploitation chain and Palo Alto Networks issued hotfixes for affected versions.
- CVE-2026-109618 and CVE-2026-109619 enable unauthenticated RCE
- Chained with CVE-2026-46300 Fragnesia for root access
- 25 servers rooted in US, Japan, Taiwan, South Korea
- Three US government-affiliated environments affected
- CISA KEV addition with October 31 federal deadline
- Hotfixes for PAN-OS 10.2-12.2 and PHP 8.0.30
Timeline
dated events in the reporting · oldest first- Oct 23, 2026Attackers begin targeting PAN-OS firewalls · Dream Security
- Oct 28, 2026CISA adds Fragnesia CVE-2026-46300 to KEV · CISA
- Oct 29, 2026Dream reports 25 servers rooted · The Hacker News
- Oct 30, 2026Unit 42 verifies PHP2Shell chain · Palo Alto Networks
- Oct 31, 2026CISA sets October 31 federal patch deadline · CISA
- Oct 23, 2026GreyNoise observes six successful exploits · The Record
What each outlet adds
beyond the shared facts- The RegisterSuspected Chinese attackers built custom PHP2Shell exploit; scanned 19,000 firewalls with FOFA
- The RecordGreyNoise observed six successful hits; Chinese-language tools plus DeepSeek code
- Cyber Security NewsCISA added CVE-2026-46300 on October 28; lists fixed Linux kernel versions
- SecurityWeekTelemetry on 22.6 million exposed PHP instances; no WordPress compromises
- Hunt.io24 perimeter firewalls plus one internal management server compromised
Coverage
oldest first · one row per article · UTC- · 3d ago
Cyber Security NewsFirst report
Attackers chain PHP2Shell and kernel exploits for root on 25 servers
Dream says custom exploits for CVE-2026-109618, CVE-2026-109619 and CVE-2026-46300 reached government-affiliated firewalls and Active Directory.
- · 3d ago
GBHackers
Attackers chain PHP2Shell flaws to root 25 firewall servers
Dream says the chain, including kernel flaw CVE-2026-46300, rooted devices in the US, Japan, Taiwan, and South Korea in under 15 minutes.
- · 3d ago
The Hacker News
PHP2Shell flaws exploited on exposed Palo Alto management interfaces
Unauthenticated RCE hits internet-facing PAN-OS management; CISA set an October 31 deadline for kernel bug CVE-2026-46300.
- · 3d ago
Hacker News · security
Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
- · 3d ago
BleepingComputer
CISA warns Fragnesia Linux flaw is chained in PHP2Shell attacks
Agencies must patch CVE-2026-46300 by Saturday 10; researchers say the chain rooted 25 servers, including three US government-affiliated hosts.
- · 3d ago
The Register · Security
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
- · 2d ago
The Record
Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
- · 2d ago
CSO Online
Attackers chain PHP2Shell with Fragnesia kernel bug for root
Dream Security says the chain rooted Palo Alto firewalls and reached Active Directory on 25 servers, three tied to the US government.
- · 2d ago
Tenable Blog
php2shell RCE confirmed on honeypots and some network appliances
Public PoCs often fail unless tuned to one PHP build, but shared appliance images let one exploit hit many devices.
- · 2d ago
CISA says attackers exploit Linux kernel flaw CVE-2026-46300
Federal agencies face an October 31 deadline; CISA says the bug is chained to plant PHP webshells and run as root.
- · 2d ago
Drupal Commerce Core authorization bypass actively exploited
CVE-2026-118539 affects Commerce Core 0.0.0–2.41 and 3.0.0–3.3.13; Drupal says to upgrade to 8.x-2.41 or 3.3.13.
- · 2d ago
Palo Alto confirms PHP2Shell attacks on exposed PAN-OS management
Unit 42 verified tools that pair the PHP flaws with kernel bug CVE-2026-46300 for root; about 0.02% of the installed base was exposed.
- · 2d ago
Infosecurity Magazine
Suspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell
The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.
- · 2d ago
SecurityWeek
PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
- · 1d ago
Attackers chain PHP2Shell flaws to root Palo Alto PAN-OS firewalls
Hunt.io says 24 perimeter firewalls and one internal management server were compromised, including a US government-affiliated environment.
- · 14h ago
Cyberattack wave hits PHP, Node.js, Binance, LiteLLM
Binance reports multibillion-dollar wallet drain while PHP and Node.js vulnerabilities require patching.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |