Chained PHP2Shell and Fragnesia Flaws Root 25 PAN-OS Servers
First merged summary.
CISA added PHP2Shell and Fragnesia to KEV catalog; federal deadline October 31, with 25 servers including US gov systems compromised.
CISA added CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities catalog on October 26 after confirming real-world exploitation. Federal civilian agencies must patch by October 29 under Binding Operational Directive 26-04. The flaws enable unauthenticated remote code execution on PHP servers. Attackers chained them with Linux kernel CVE-2026-46300 (Fragnesia) to gain root on 25 Palo Alto Networks firewall and management servers in the United States, Japan, Taiwan, and South Korea, including three in a U.S. government-affiliated environment. Unit 42 verified attacker tools and Palo Alto Networks confirmed exploitation of exposed management interfaces.
- CISA KEV: CVE-2026-109618, CVE-2026-109619, CVE-2026-46300
- Patches: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
- Fragnesia deadline: October 31 under BOD 26-04
- 25 servers rooted including 3 US gov-affiliated
- OffSec released free PHP2Shell lab and Exploit-DB PoC
- PAN-OS 10.2-12.2 affected on exposed management interfaces
Timeline
dated events in the reporting · oldest first- Aug 19, 2026Wiz discovered PHP2Shell flaws using AI-assisted review · OffSec
- Oct 21, 2026PHP released patches for CVE-2026-109618 and CVE-2026-109619 · The Register
- Oct 23, 2026Two US government-affiliated servers compromised · The Hacker News
- Oct 25, 2026Attackers chained flaws to root 25 servers · The Hacker News
- Oct 26, 2026CISA added PHP2Shell to KEV catalog · Cyber Security News
- Oct 28, 2026CISA added Fragnesia CVE-2026-46300 to KEV catalog · BleepingComputer
What each outlet adds
beyond the shared facts- OffSecReleased free Proving Grounds lab and Exploit-DB PoC for PHP2Shell
- The Hacker NewsReported chaining led to 25 servers rooted including 3 US gov-affiliated, suspected China nexus with AI tools
- Unit 42Verified attacker tools chaining PHP2Shell to kernel flaw; counted 22.6 million exposed PHP instances
- Palo Alto NetworksConfirmed exploitation of PHP2Shell on PAN-OS management interfaces
- The RegisterCISA confirmed KEV addition and federal deadlines for PHP flaws
Coverage
oldest first · one row per article · UTC- · 15d ago
The RecordFirst report
CISA orders agencies to patch two targeted PHP bugs by Thursday
CVE-2026-109618 and CVE-2026-109619 drew thousands of failed attempts; confirmed successful exploitation remains unproven.
- · 15d ago
Wiz Blog
Wiz reports limited PHP2Shell exploitation attempts after disclosure
Internet-exposed vulnerable machines fell about 67 percent, and captured attempts did not finish a general exploit chain.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-115560 | — | — | PoC ×11 | — | |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |