Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
Summary: Palo Alto Networks warned on Wednesday that attackers are exploiting the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), to achieve unauthenticated remote code execution against internet-exposed management interfaces, after the PHP Foundation patched the flaws upstream on October 21, 2026. Dream reported a suspected China-nexus actor chaining the flaws with the Linux kernel privilege escalation bug Fragnesia (CVE-2026-46300) to root 25 servers across the U.S., Japan, Taiwan, and South Korea, including three systems in a U.S. government-affiliated environment, and CISA added CVE-2026-46300 to its KEV catalog with a federal fix deadline of October 31, 2026.
Bottom line: The attacker obtained PAN-OS firmware, decrypted it, extracted PHP libraries, and built memory profiles for nine software versions before rooting 25 servers, three of them in a U.S. government-affiliated environment, and then moved against Active Directory to extract credentials.
Read the original at The Hacker News ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2026-109618CVE-2026-109619CVE-2026-46300
- Related
- Siemens Building Automation and Energy Products Cyber Risks · Nov 12, 2026Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) Cyber Risks · Oct 29, 2026