StoryExploit / PoCcriticalExploited in the wild

PHP2Shell Flaws Chained with Fragnesia to Root Palo Alto Servers

12 sources · 19 articlesFirst reported Oct 28, 2026 · 17:54 UTCUpdated Oct 31, 2026 · 07:59 UTC (16h ago)

What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Attackers chained PHP2Shell and Fragnesia vulnerabilities to gain root on 25 Palo Alto Networks firewalls, including three US government-affiliated systems.

Wiz discovered memory corruption bugs in PHP allowing unauthenticated remote code execution on August 19 using AI-assisted review. Attackers exploited CVE-2026-109618 and CVE-2026-109619 against internet-exposed PAN-OS management interfaces, then chained them with Linux kernel flaw CVE-2026-46300 known as Fragnesia to achieve root access. Dream Security reported 25 compromised servers in the US, Japan, Taiwan and South Korea, including three in a US government-affiliated environment, with suspected Chinese nation-state actor involvement. CISA added both the PHP flaws and Fragnesia to the KEV catalog on October 26 with a federal agency remediation deadline of October 31.

Key facts

PHP2Shell CVE-2026-109618 and CVE-2026-109619 found August 19, CVSS 9.2
Fixed PHP versions: 8.2.35, 8.3.36, 8.4.27, 8.5.12
Fragnesia CVE-2026-46300 added to KEV October 26, root escalation
25 servers rooted including 3 US government-affiliated
PAN-OS hotfixes: 12.2.4-h1, 12.1.10-h3, 11.2.16-h1
Disabling session.upload_progress.enabled reduces exposure

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first

Aug 19, 2026Wiz discovers PHP2Shell flaws using AI · Cyber Security News
Oct 21, 2026PHP discloses PHP2Shell flaws with 9.2 score · BleepingComputer
Oct 23, 2026Honeypots show command execution via PHP2Shell · Infosecurity Magazine
Oct 26, 2026CISA adds PHP2Shell and Fragnesia to KEV · The Hacker News
Oct 28, 2026OffSec releases PHP2Shell lab and CISA deadline · GBHackers
Oct 31, 2026CISA federal agencies must patch Fragnesia · CSO Online

What each outlet adds

beyond the shared facts

Unit 42Verified attacker tools chaining PHP2Shell with Fragnesia for root
Dream SecurityReported 25 rooted servers including three US government-affiliated
CISAAdded vulnerabilities to KEV and set October 31 federal patch deadline
Palo Alto NetworksConfirmed exploitation of exposed management interfaces and provided hotfixes
OffSecReleased free PHP2Shell lab and proof-of-concept exploit

CVEs: CVE-2026-109618 CVE-2026-109619 CVE-2026-46300 CVE-2026-115560

Vendors: Palo Alto Networks PHP Foundation PHP Group PHP
Products: PAN-OS Panorama PHP WordPress Linux kernel PA-Series VM-Series Linux
Organizations: Dream Unit 42 Defiant Cato Networks WatchTowr CISA Dream Security Dream Research OffSec Wiz Amazon Hunt.io
Countries: China United States Japan Taiwan South Korea
AI models: DeepSeek Kimi Claude Code

Coverage

oldest first · one row per article · UTC

Oct 28, 17:54 UTC · 3d ago Cyber Security NewsFirst report
PHP2Shell flaws exploited in the wild; OffSec ships free lab
CISA listed both flaws on October 26; fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Oct 28, 17:56 UTC · 3d ago GBHackers
PHP2Shell flaws exploited in the wild; OffSec ships free lab
CISA listed both flaws on October 26; fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Oct 28, 18:26 UTC · 3d ago Wordfence
Wordfence sees no confirmed WordPress compromises from PHP2Shell
From October 23 to 27 Wordfence logged about 77,600 PHP2Shell requests from more than 2,000 IPs and still urges a PHP update plus restart.
Oct 29, 03:55 UTC · 2d ago Cyber Security News
Attackers chain PHP2Shell and kernel exploits for root on 25 servers
Dream says custom exploits for CVE-2026-109618, CVE-2026-109619 and CVE-2026-46300 reached government-affiliated firewalls and Active Directory.
Oct 29, 04:59 UTC · 2d ago GBHackers
Attackers chain PHP2Shell flaws to root 25 firewall servers
Dream says the chain, including kernel flaw CVE-2026-46300, rooted devices in the US, Japan, Taiwan, and South Korea in under 15 minutes.
Oct 29, 05:50 UTC · 2d ago The Hacker News
PHP2Shell flaws exploited on exposed Palo Alto management interfaces
Unauthenticated RCE hits internet-facing PAN-OS management; CISA set an October 31 deadline for kernel bug CVE-2026-46300.
Oct 29, 08:25 UTC · 2d ago CSO Online
CISA confirms active exploitation of PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619
Official fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while many appliance and EOL runtimes have no direct patch.
Oct 29, 10:42 UTC · 2d ago Hacker News · security
Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
Oct 29, 13:59 UTC · 2d ago BleepingComputer
CISA warns Fragnesia Linux flaw is chained in PHP2Shell attacks
Agencies must patch CVE-2026-46300 by Saturday 10; researchers say the chain rooted 25 servers, including three US government-affiliated hosts.
Oct 29, 19:05 UTC · 2d ago The Register · Security
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
Oct 29, 20:01 UTC · 2d ago The Record
Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
Oct 30, 00:55 UTC · 1d ago CSO Online
Attackers chain PHP2Shell with Fragnesia kernel bug for root
Dream Security says the chain rooted Palo Alto firewalls and reached Active Directory on 25 servers, three tied to the US government.
Oct 30, 01:42 UTC · 1d ago Tenable Blog
php2shell RCE confirmed on honeypots and some network appliances
Public PoCs often fail unless tuned to one PHP build, but shared appliance images let one exploit hit many devices.
Oct 30, 04:10 UTC · 1d ago Cyber Security News
CISA says attackers exploit Linux kernel flaw CVE-2026-46300
Federal agencies face an October 31 deadline; CISA says the bug is chained to plant PHP webshells and run as root.
Oct 30, 07:45 UTC · 1d ago The Hacker News
Drupal Commerce Core authorization bypass actively exploited
CVE-2026-118539 affects Commerce Core 0.0.0–2.41 and 3.0.0–3.3.13; Drupal says to upgrade to 8.x-2.41 or 3.3.13.
Oct 30, 10:42 UTC · 1d ago Cyber Security News
Palo Alto confirms PHP2Shell attacks on exposed PAN-OS management
Unit 42 verified tools that pair the PHP flaws with kernel bug CVE-2026-46300 for root; about 0.02% of the installed base was exposed.
Oct 30, 12:00 UTC · 1d ago Infosecurity Magazine
Suspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell
The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.
Oct 30, 15:09 UTC · 1d ago SecurityWeek
PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
Oct 31, 07:59 UTC · 16h ago GBHackers
Attackers chain PHP2Shell flaws to root Palo Alto PAN-OS firewalls
Hunt.io says 24 perimeter firewalls and one internal management server were compromised, including a US government-affiliated environment.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-109618 +1 related CVE CVE-2026-109619	OOM longjmp memory flaw enabling RCE in PHP	9.2	100%	KEVPoC ×25	10d ago KEV Oct 26, 2026
CVE-2026-115560		—	—	PoC ×11	—
CVE-2026-46300	Shared-frag marker loss in Linux kernel skb coalescing (LPE)	7.8	16%	KEVPoC	May 23, 2026 KEV Oct 28, 2026