PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
Stories per day · 30 days
5 RSS
Relatedpan-os20kev10firewall9cve-2026-03228rce8cisa5zero-day5php2shell4qilin4cisco3globalprotect3ransomware3advisory2ahsay2canada2code-injection2initial-access2management-interface2
27 stories, newest first · one card per story
Stories tagged #palo-alto
Palo Alto confirms PHP2Shell attacks on exposed PAN-OS management
Unit 42 verified tools that pair the PHP flaws with kernel bug CVE-2026-46300 for root; about 0.02% of the installed base was exposed.
PHP2Shell flaws exploited on exposed Palo Alto management interfaces
Unauthenticated RCE hits internet-facing PAN-OS management; CISA set an October 31 deadline for kernel bug CVE-2026-46300.
Palo Alto says Brotli flaw can hit some PAN-OS firewalls (CVE-2026-111497)
The CVSS 9.2 decoder bug needs Brotli inspection plus decryption; no exploitation is known, and hotfixes are only estimated.
Palo Alto says PHP RCE flaws affect PAN-OS; hotfixes still pending
CVE-2026-109618 and CVE-2026-109619 hit several PAN-OS branches via management interfaces; Palo Alto reports no attacks on its products.
k0t exploits edge firewalls and VPNs, exposing over 70,000 credentials
Group-IB and NyxLab say k0t used FortiWeb and PAN-OS flaws, then remote-access tools and cloud exfiltration, from February to June 2026.
Ransomware groups exploit Palo Alto GlobalProtect flaw CVE-2026-0257
Unit 42 has investigated intrusions since early June; Qilin, Inc, and Settra are among the operators named.
2
Qilin and INC exploit patched Palo Alto VPN bypass (CVE-2026-0257)
Unit 42 says the groups still use the May 2026 PAN-OS and Prisma Access fix to open unauthorized VPNs.
Ransomware groups exploit PAN-OS flaw CVE-2026-0257 to bypass MFA
Unit 42 says the GlobalProtect cookie bug yielded VPN access and later ransomware across several sectors since early June 2026.
2
Ransomware groups exploit GlobalProtect MFA bypass CVE-2026-0257
Unit 42 says attackers forged authentication-override cookies, then pulled domain credentials from a VMware virtual disk offline.
1
Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026
Unit 42 says September 2026 intrusions most often began with edge exploits and abused credentials.
2
Palo Alto Networks security advisory (AV26-1056)
Canada’s Cyber Centre flags a Palo Alto Idira Secrets Manager flaw fixed in version 13.9.1.
U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Palo Alto PAN-OS, Cisco email gateway, and AhsayCBS flaws to the KEV catalog.
Palo Alto Warns of PAN-OS 0-day Flaw Actively Exploited in Attacks
Palo Alto says attackers are exploiting CVE-2026-0322, an authenticated PAN-OS management RCE that yields root.
Palo Alto Networks (PAN-OS) Remote Code Execution Vulnerability Exploited in Attack (CVE-2026-0322)
Attackers are exploiting CVE-2026-0322, an authenticated PAN-OS flaw that enables root code execution.
Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix
Attackers are exploiting PAN-OS CVE-2026-0322 for root access; CISA set a three-day fix.
Cisco Secure Email & PAN-OS Zero-Days Exploited
Cisco and Palo Alto patched two actively exploited zero-days enabling root code execution on email and PAN-OS appliances.
CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products
CISA added exploited Palo Alto, Cisco, and Ahsay flaws to KEV, with a three-day federal deadline.
Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
Palo Alto patched PAN-OS zero-day CVE-2026-0322 after limited exploitation for root remote code execution.
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto patches exploited PAN-OS management RCE CVE-2026-0322; CISA set an October 17 deadline.
Hackers Exploit Palo Alto PAN-OS 0-day Flaw to Gain Root Code Execution on Firewalls
Attackers are exploiting PAN-OS CVE-2026-0322 for limited root code execution through the management interface.
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
Palo Alto says attackers are exploiting PAN-OS RCE CVE-2026-0322, which CISA added to KEV.
Palo Alto Networks security advisory (AV26-1041)
Canada’s Cyber Centre urges patches for PAN-OS and Prisma Browser, including authenticated RCE CVE-2026-0322.
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
Qilin and Settra are still exploiting Palo Alto CVE-2026-0257 to open unauthorized VPN sessions.