PHP2Shell and kernel flaw root exposed Palo Alto firewalls
October 31: Hunt.io, citing Dream, says a custom appweb exploit hit 24 perimeter firewalls and one internal management server after narrowing about 19,000 exposed devices to 240 targets.
Attackers chained PHP2Shell with a Linux kernel flaw to root at least 25 exposed Palo Alto systems, including US government-affiliated hosts.
CISA listed PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 on October 26, with a civilian-agency deadline of October 29, and added Linux kernel bug CVE-2026-46300, called Fragnesia, due October 31. Palo Alto Networks says the PHP bugs were used for unauthenticated remote code execution on internet-exposed PAN-OS management interfaces; Unit 42 says verified tools then used the kernel flaw to reach root. Dream reports 25 servers rooted in the United States, Japan, Taiwan, and South Korea from October 23 to 24, including three US government-affiliated hosts. Infosecurity Magazine, citing Dream, calls the actor a suspected Chinese nation-state that reached a US government Active Directory domain; SecurityWeek describes a China-linked group and at least 25 firewalls. PHP fixed the bugs on October 21, Palo Alto issued branch hotfixes, and known ransomware use is unknown.
- PHP fixes are 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released October 21.
- PAN-OS hotfixes include 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4, and 10.2.18-h13.
- Unit 42 says about 0.02% of the installed base had exposed management interfaces.
- Unit 42 counted over 22.6 million potentially exposed PHP instances, not confirmed breaches.
- GlobalProtect, Clientless VPN, and Captive Portal are not affected.
- Known ransomware campaign use is listed as unknown.
Timeline
dated events in the reporting · oldest first- Oct 21, 2026PHP released fixes for the PHP2Shell bugs. · The Hacker News
- Oct 23, 2026Dream says the exploit chain rooted servers through October 24. · Infosecurity Magazine
- Oct 26, 2026CISA added both PHP flaws to KEV, due October 29. · CISA Known Exploited Vulnerabilities
- Oct 28, 2026CISA added kernel flaw CVE-2026-46300, due October 31. · CISA Known Exploited Vulnerabilities
- Oct 29, 2026Unit 42 verified tools pairing PHP flaws with the kernel bug. · Cyber Security News
- Oct 31, 2026Hunt.io detailed 24 firewalls and one management server. · GBHackers
What each outlet adds
beyond the shared facts- The RecordThousands of failed attempts, Censys patching figures, and early retracted claims.
- SecurityWeekNo known WordPress compromise; Cato and WatchTowr scanning statistics.
- Infosecurity MagazineSuspected Chinese actor and claimed Active Directory domain access.
- Cyber Security NewsUnit 42 verification, hotfix list, and unaffected PAN-OS features.
- GBHackersHunt.io count of 24 firewalls plus one internal management server.
Coverage
oldest first · one row per article · UTC- · 5d ago
CISA Known Exploited VulnerabilitiesFirst report
CISA KEV lists PHP request-state flaw enabling unauthenticated RCE
CVE-2026-109619 is a stale internal request-state bug; the federal remediation due date is October 29.
- · 5d ago
CISA KEV lists PHP memory-corruption flaw enabling unauthenticated RCE
CVE-2026-109618 is an out-of-memory corruption bug; federal due date is October 29, and ransomware use is unknown.
- · 5d ago
GBHackers
Public PoC exploits PHP2Shell for RCE on PHP 8.4.26
The PoC is tuned for Alpine PHP 8.4.26 and succeeded in seven of ten lab runs.
- · 4d ago
Full Disclosure
PHP CGI pointer underflow allows unauthenticated RCE (CVE-2026-109618)
Default cgi.fix_pathinfo exposes PHP 5.x through 8.4.26; only the 8.2 and later branches are scheduled to be fixed.
- · 3d ago
The Record
CISA orders agencies to patch two targeted PHP bugs by Thursday
CVE-2026-109618 and CVE-2026-109619 drew thousands of failed attempts; confirmed successful exploitation remains unproven.
- · 3d ago
CISA KEV: Linux kernel CVE-2026-46300 due October 31
The flaw can alter page-cache data and, chained with two other CVEs, implant PHP webshells that run as root.
- · 2d ago
Wordfence
Wordfence sees no confirmed WordPress compromises from PHP2Shell
From October 23 to 27 Wordfence logged about 77,600 PHP2Shell requests from more than 2,000 IPs and still urges a PHP update plus restart.
- · 2d ago
The Hacker News
PHP2Shell flaws exploited on exposed Palo Alto management interfaces
Unauthenticated RCE hits internet-facing PAN-OS management; CISA set an October 31 deadline for kernel bug CVE-2026-46300.
- · 2d ago
CSO Online
CISA confirms active exploitation of PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619
Official fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while many appliance and EOL runtimes have no direct patch.
- · 1d ago
Hacker News · security
Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
- · 1d ago
BleepingComputer
CISA warns Fragnesia Linux flaw is chained in PHP2Shell attacks
Agencies must patch CVE-2026-46300 by Saturday 10; researchers say the chain rooted 25 servers, including three US government-affiliated hosts.
- · 1d ago
The Register · Security
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
- · 1d ago
Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
- · 1d ago
Attackers chain PHP2Shell with Fragnesia kernel bug for root
Dream Security says the chain rooted Palo Alto firewalls and reached Active Directory on 25 servers, three tied to the US government.
- · 1d ago
Tenable Blog
php2shell RCE confirmed on honeypots and some network appliances
Public PoCs often fail unless tuned to one PHP build, but shared appliance images let one exploit hit many devices.
- · 1d ago
Cyber Security News
CISA says attackers exploit Linux kernel flaw CVE-2026-46300
Federal agencies face an October 31 deadline; CISA says the bug is chained to plant PHP webshells and run as root.
- · 1d ago
Drupal Commerce Core authorization bypass actively exploited
CVE-2026-118539 affects Commerce Core 0.0.0–2.41 and 3.0.0–3.3.13; Drupal says to upgrade to 8.x-2.41 or 3.3.13.
- · 23h ago
Drupal Commerce Core access bypass exploited in attacks
Unauthenticated attackers can bypass route and field protections on more than 42,000 sites and may cause financial loss.
- · 22h ago
Palo Alto confirms PHP2Shell attacks on exposed PAN-OS management
Unit 42 verified tools that pair the PHP flaws with kernel bug CVE-2026-46300 for root; about 0.02% of the installed base was exposed.
- · 22h ago
SecurityWeek
Drupal Commerce Core access bypass exploited against online stores
Unauthenticated attackers can hit the flaw on more than 42,000 sites; fixed releases are 3.3.13 and 8.x-2.41.
- · 21h ago
Infosecurity Magazine
Suspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell
The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.
- · 18h ago
PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
- · 17h ago
Canadian Centre for Cyber Security
Drupal Commerce Core access bypass reported exploited in the wild
Releases before 2.41 and 3.0.0 before 3.3.13 are affected; Drupal rates the issue highly critical.
- · 1h ago
Attackers chain PHP2Shell flaws to root Palo Alto PAN-OS firewalls
Hunt.io says 24 perimeter firewalls and one internal management server were compromised, including a US government-affiliated environment.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |