PHP2Shell chain roots about 25 Palo Alto firewalls
First merged summary.
Attackers chained PHP2Shell with a Linux kernel bug to root about 25 PAN-OS systems; CISA’s patch deadline was October 31.
Attackers are exploiting PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 on internet-exposed Palo Alto Networks PAN-OS management interfaces and chaining them with Linux kernel bug CVE-2026-46300, Fragnesia, to gain root. Dream Research says the activity rooted 25 servers in the United States, Japan, Taiwan and South Korea, including three in a U.S. government-affiliated environment; Unit 42 verified the tooling. The Hacker News, citing Dream, says later credential-attack success is unclear, while Infosecurity Magazine says Unit 42 found Active Directory access and that full data theft is unconfirmed. Dream attributes the work to suspected China-nexus operators. PHP fixes shipped October 21, Palo Alto issued hotfixes, and CISA set an October 31 federal deadline for the kernel flaw.
- Fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- PAN-OS hotfixes include 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4 and 10.2.18-h13.
- Dream says about 19,000 exposed firewalls were narrowed to 240 targets.
- Unit 42 says about 0.02% of the installed base had exposed management interfaces.
- GlobalProtect, Clientless VPN and Captive Portal are not affected.
- Kernel fixes include 6.12.91 and 7.0.10; Linux 7.1 is unaffected.
Timeline
dated events in the reporting · oldest first- Oct 21, 2026PHP disclosed fixes for PHP2Shell, scored 9.2. · The Hacker News
- Oct 23, 2026Government-linked PAN-OS systems were compromised, Dream says. · The Hacker News
- Oct 26, 2026CISA added both PHP2Shell flaws to the KEV catalog. · Cyber Security News
- Oct 28, 2026CISA added CVE-2026-46300 to KEV, deadline October 31. · Cyber Security News
- Oct 29, 2026Unit 42 verified tools chaining PHP2Shell with Fragnesia. · Cyber Security News
- Oct 31, 2026Hunt.io detailed 25 compromised PAN-OS systems. · GBHackers
What each outlet adds
beyond the shared facts- The Hacker NewsDream targeting counts, reverse SSH tunnel, and AI-tooling claim.
- BleepingComputerPublic kernel PoC for builds before May 13; CISA gave no attacker details.
- Cyber Security NewsKernel fixed versions and a CVSS score of 7.8.
- Infosecurity MagazineTwo hosts saw further access; root webshell in under 15 minutes.
- SecurityWeekDefiant saw no WordPress compromise; Cato and WatchTowr scan telemetry.
Coverage
oldest first · one row per article · UTC- · 3d ago
The Hacker NewsFirst report
PHP2Shell campaign roots 25 servers, including U.S. government-linked hosts
Dream says a custom exploit plus a Linux kernel bug rooted firewalls in the U.S., Japan, Taiwan, and South Korea.
- · 3d ago
Cyber Security News
PHP2Shell flaws exploited in the wild; OffSec ships free lab
CISA listed both flaws on October 26; fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- · 3d ago
GBHackers
PHP2Shell flaws exploited in the wild; OffSec ships free lab
CISA listed both flaws on October 26; fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- · 3d ago
Wordfence
Wordfence sees no confirmed WordPress compromises from PHP2Shell
From October 23 to 27 Wordfence logged about 77,600 PHP2Shell requests from more than 2,000 IPs and still urges a PHP update plus restart.
- · 2d ago
Attackers chain PHP2Shell and kernel exploits for root on 25 servers
Dream says custom exploits for CVE-2026-109618, CVE-2026-109619 and CVE-2026-46300 reached government-affiliated firewalls and Active Directory.
- · 2d ago
Attackers chain PHP2Shell flaws to root 25 firewall servers
Dream says the chain, including kernel flaw CVE-2026-46300, rooted devices in the US, Japan, Taiwan, and South Korea in under 15 minutes.
- · 2d ago
PHP2Shell flaws exploited on exposed Palo Alto management interfaces
Unauthenticated RCE hits internet-facing PAN-OS management; CISA set an October 31 deadline for kernel bug CVE-2026-46300.
- · 2d ago
CSO Online
CISA confirms active exploitation of PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619
Official fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while many appliance and EOL runtimes have no direct patch.
- · 2d ago
Hacker News · security
Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
- · 2d ago
BleepingComputer
CISA warns Fragnesia Linux flaw is chained in PHP2Shell attacks
Agencies must patch CVE-2026-46300 by Saturday 10; researchers say the chain rooted 25 servers, including three US government-affiliated hosts.
- · 2d ago
The Register · Security
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
- · 2d ago
The Record
Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
- · 1d ago
Attackers chain PHP2Shell with Fragnesia kernel bug for root
Dream Security says the chain rooted Palo Alto firewalls and reached Active Directory on 25 servers, three tied to the US government.
- · 1d ago
Tenable Blog
php2shell RCE confirmed on honeypots and some network appliances
Public PoCs often fail unless tuned to one PHP build, but shared appliance images let one exploit hit many devices.
- · 1d ago
CISA says attackers exploit Linux kernel flaw CVE-2026-46300
Federal agencies face an October 31 deadline; CISA says the bug is chained to plant PHP webshells and run as root.
- · 1d ago
Drupal Commerce Core authorization bypass actively exploited
CVE-2026-118539 affects Commerce Core 0.0.0–2.41 and 3.0.0–3.3.13; Drupal says to upgrade to 8.x-2.41 or 3.3.13.
- · 1d ago
Palo Alto confirms PHP2Shell attacks on exposed PAN-OS management
Unit 42 verified tools that pair the PHP flaws with kernel bug CVE-2026-46300 for root; about 0.02% of the installed base was exposed.
- · 1d ago
Infosecurity Magazine
Suspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell
The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.
- · 1d ago
SecurityWeek
PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
- · 13h ago
Attackers chain PHP2Shell flaws to root Palo Alto PAN-OS firewalls
Hunt.io says 24 perimeter firewalls and one internal management server were compromised, including a US government-affiliated environment.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-115560 | — | — | PoC ×11 | — | |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |