PHP2Shell and Fragnesia Flaws Chained to Root 25 Servers
October 29: Palo Alto Networks confirms exploitation of internet-exposed management interfaces; Dream reports custom exploits and 25 server rootings.
Attackers chained PHP2Shell flaws with Fragnesia kernel vulnerability to root 25 internet-exposed Palo Alto firewalls including US government-linked ones.
Attackers used public exploit code for PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 to enable unauthenticated remote code execution on PHP engines dating to 5.4. These were chained with the Linux kernel Fragnesia flaw CVE-2026-46300 to gain root on 25 servers, primarily Palo Alto Networks PAN-OS firewalls exposed to the internet in the US, Japan, Taiwan, and South Korea, including three government-affiliated ones. CISA added both sets of flaws to its Known Exploited Vulnerabilities catalog, with PHP fixes released on October 21 and remediation deadlines of October 29 and October 31.
- CVE-2026-109618 and CVE-2026-109619 fixed in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 on October 21
- CISA added PHP2Shell to KEV on October 26; Fragnesia CVE-2026-46300 on October 28
- Chained exploits rooted 25 servers including three US government-affiliated
- Censys estimates over 32.51 million PHP services on affected versions
- Attackers opened reverse SSH tunnels for Active Directory attempts post-rooting
- OffSec released free lab and PoC for PHP2Shell
Timeline
dated events in the reporting · oldest first- Oct 17, 2026Probings for PHP2Shell began · Cyber Security News
- Oct 21, 2026PHP released fixes for PHP2Shell · The Hacker News
- Oct 24, 2026RCE demonstrated against honeypots · The Hacker News
- Oct 26, 2026CISA added PHP2Shell to KEV · Security Affairs
- Oct 28, 2026CISA added Fragnesia to KEV · CISA
- Oct 25, 2026Chained exploits rooted 25 servers · The Hacker News
What each outlet adds
beyond the shared facts- The Hacker NewsDetails on 25 servers rooted including US government-affiliated networks and Chinese operators
- Security AffairsCloudflare reports rising exploit attempts to millions by October 22
- CISAOfficial KEV entries, chaining details, and BOD 26-04 deadlines
- Dream SecuritySpecific targeting of Palo Alto firewalls and locations in multiple countries
- OffSecFree Proving Grounds lab and Exploit-DB PoC for PHP2Shell
Coverage
oldest first · one row per article · UTC- · 6d ago
Security AffairsFirst report
Suspected North Korean campaign targets 216 vulnerable PHP hosts
Cyfirma links a Lazarus-linked group using AI-ranked public exploits to monitor and scan 216 unpatched PHP hosts via private I2P channel.
- · 6d ago
ESET WeLiveSecurity
Critical PHP flaws dubbed PHP2Shell allow unauthenticated code execution
Early exploit attempts followed disclosure, and some sites went offline while owners applied patches.
- · 6d ago
SecurityWeek
PHP2Shell exploitation confirmed with working shells on honeypots
Karimi logged 35 shells on October 24 across three PHP 8.4.26 honeypots; CISA had not added the flaws to KEV.
- · 6d ago
Industrial vendors assess PHP2Shell; several OT products affected
Unauthenticated PHP RCE flaws drew millions of attempts, with the first confirmed attacks aimed at honeypots.
- · 6d ago
Tenable Blog
Tenable outlines detection and patching for PHP2Shell
CVE-2026-109618 and CVE-2026-109619 affect PHP, which Tenable says runs on more than 70% of websites.
- · 6d ago
Cyber Security News
Attackers use public PHP2Shell exploits against university and business sites
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated command execution; fixed PHP builds shipped on October 21.
- · 6d ago
The Hacker News
CISA confirms active exploitation of two PHP2Shell RCE flaws
Both flaws score CVSS 9.2; fixes shipped October 21, and US agencies must patch by October 29.
- · 6d ago
Full Disclosure
PHP CGI pointer underflow allows unauthenticated RCE (CVE-2026-109618)
Default cgi.fix_pathinfo exposes PHP 5.x through 8.4.26; only the 8.2 and later branches are scheduled to be fixed.
- · 6d ago
BleepingComputer
CISA says PHP2Shell flaws are exploited for remote code execution
FCEB agencies must remediate CVE-2026-109618 and CVE-2026-109619 by Thursday; a separate RCE still has no patch.
- · 5d ago
CISA adds exploited PHP2Shell flaws to its KEV catalog
Unauthenticated HTTP requests can run code on PHP engines dating to PHP 5.4; agencies must fix by October 29, 2026.
- · 5d ago
Cloudflare Blog
Cloudflare opens PHP CTF for php2shell WAF bypasses
HackerOne participants must get code execution on PHP 8.5.11, read a resetting flag, and privately report a distinct bypass.
- · 5d ago
The Record
CISA orders agencies to patch two targeted PHP bugs by Thursday
CVE-2026-109618 and CVE-2026-109619 drew thousands of failed attempts; confirmed successful exploitation remains unproven.
- · 5d ago
Wiz Blog
Wiz reports limited PHP2Shell exploitation attempts after disclosure
Internet-exposed vulnerable machines fell about 67 percent, and captured attempts did not finish a general exploit chain.
- · 5d ago
The Register · Security
CISA confirms both PHP2Shell flaws are exploited and adds them to KEV
Federal civilian agencies must fix CVE-2026-109618 and CVE-2026-109619 by October 29; patched builds are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- · 5d ago
Hacker News · AI
PHP2Shell attempts preceded same-week patches for PHP, GitLab and Node.js
GitLab’s unauthenticated RCE is CVSS 10.0 back to version 7.0; LiteLLM 1.107.0 stole credentials and OpenCode keys may have leaked.
- · 5d ago
CISA Known Exploited Vulnerabilities
CISA KEV: Linux kernel CVE-2026-46300 due October 31
The flaw can alter page-cache data and, chained with two other CVEs, implant PHP webshells that run as root.
- · 5d ago
Lobsters · security
Blog argues rapid disclosures leave defenders unable to keep up
A week of KVM, PHP, CA, and Brotli issues shows fixes arrive faster than inventory, assessment, and rollout.
- · 5d ago
CISA says PHP2Shell flaws are exploited for remote code execution
Federal civilian agencies must mitigate CVE-2026-109618 and CVE-2026-109619 or remove affected products by October 29.
- · 4d ago
ESET reviews a week of PHP, kernel, and LiteLLM incidents
PHP fixes shipped October 21; nine firms, including ESET, told NBC News they had seen no successful PHP2Shell attacks.
- · 4d ago
China-linked hackers root firewalls via PHP2Shell and Fragnesia
Dream says attackers exploited 25 of 19,000 internet-facing firewalls on October 23-24 and planted root webshells on 24.
- · 4d ago
PHP2Shell campaign roots 25 servers, including U.S. government-linked hosts
Dream says a custom exploit plus a Linux kernel bug rooted firewalls in the U.S., Japan, Taiwan, and South Korea.
- · 4d ago
PHP2Shell flaws exploited in the wild; OffSec ships free lab
CISA listed both flaws on October 26; fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- · 4d ago
GBHackers
PHP2Shell flaws exploited in the wild; OffSec ships free lab
CISA listed both flaws on October 26; fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- · 4d ago
Wordfence
Wordfence sees no confirmed WordPress compromises from PHP2Shell
From October 23 to 27 Wordfence logged about 77,600 PHP2Shell requests from more than 2,000 IPs and still urges a PHP update plus restart.
- · 4d ago
Attackers chain PHP2Shell and kernel exploits for root on 25 servers
Dream says custom exploits for CVE-2026-109618, CVE-2026-109619 and CVE-2026-46300 reached government-affiliated firewalls and Active Directory.
- · 4d ago
Attackers chain PHP2Shell flaws to root 25 firewall servers
Dream says the chain, including kernel flaw CVE-2026-46300, rooted devices in the US, Japan, Taiwan, and South Korea in under 15 minutes.
- · 4d ago
PHP2Shell flaws exploited on exposed Palo Alto management interfaces
Unauthenticated RCE hits internet-facing PAN-OS management; CISA set an October 31 deadline for kernel bug CVE-2026-46300.
- · 4d ago
CSO Online
CISA confirms active exploitation of PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619
Official fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while many appliance and EOL runtimes have no direct patch.
- · 3d ago
Hacker News · security
Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
- · 3d ago
CISA warns Fragnesia Linux flaw is chained in PHP2Shell attacks
Agencies must patch CVE-2026-46300 by Saturday 10; researchers say the chain rooted 25 servers, including three US government-affiliated hosts.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-115560 | — | — | PoC ×11 | — | |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |