[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5383uXN8fs5Jjkz7v8QexQLjUJL6A3UsOJpisvdpLHE":3},{"article":4,"iocs":54,"watch_terms":65,"solutions":66,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"7e516d1e-2f08-4246-ac3f-2df72232672d","PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress","php2shell-attacks-root-palo-alto-firewalls-but-fail-against-wordpress-a7785c","Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week. The post PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress appeared first on SecurityWeek.","Threat actors have been exploiting PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) for over a week, with a China-linked group successfully chaining these flaws with the Fragnesia Linux kernel privilege escalation vulnerability to gain root access to at least 25 Palo Alto Networks firewalls. While over 22.6 million exposed PHP instances are potentially vulnerable, exploitation attempts against WordPress and other platforms have largely failed, though patches are now available for affected PAN-OS versions.","China-linked hackers chain PHP2Shell CVEs with Fragnesia kernel bug to root Palo Alto firewalls","https:\u002F\u002Fwww.securityweek.com\u002Fphp2shell-attacks-root-palo-alto-firewalls-but-fail-against-wordpress\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fphp-exploit-code.webp","2026-10-30T15:09:25+00:00","2026-10-30T16:00:15.895331+00:00",9,[17,20,23,25,28,30],{"name":18,"type":19},"Palo Alto Networks","vendor",{"name":21,"type":22},"PAN-OS","product",{"name":24,"type":22},"Panorama",{"name":26,"type":27},"China-linked hacking group","threat_actor",{"name":29,"type":22},"WordPress",{"name":31,"type":32},"PHP","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":33,"icon":35,"name":36,"slug":37},null,"Vulnerabilities","vulnerabilities",[39,44,49],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,61],{"type":56,"value":57,"context":58},"cve","CVE-2026-109618","PHP2Shell vulnerability in Palo Alto Networks PAN-OS devices",{"type":56,"value":60,"context":58},"CVE-2026-109619",{"type":62,"value":63,"context":64},"malware","Fragnesia","Linux kernel privilege escalation vulnerability chained with PHP2Shell",[18,21,29],{"controls":67,"vendors":155},[68,97,126],{"slug":69,"name":70,"problem":71,"products":72},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":98,"name":99,"problem":100,"products":101},"patch-management","Automated patch management","Known holes get closed in days, not months.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":127,"name":128,"problem":129,"products":130},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"clavister","Clavister","\u002Fvendor-logos\u002Fclavister.png","clavister-netwall","Clavister NetWall","https:\u002F\u002Fwww.clavister.com\u002Fproducts\u002Fclavister-netwall\u002F","Next-generation firewalls developed in Sweden.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-firewall","Sophos Firewall","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fnext-gen-firewall","Next-generation firewall with intrusion prevention.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","secure-firewall","Cisco Secure Firewall","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Ffirewalls\u002Findex.html","Next-generation firewalls with intrusion prevention, using Talos threat intelligence.",[156],{"slug":157,"name":18,"logo_path":158,"roles":159},"palo-alto-networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[160,161],"affected","reported_by",{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":174},"unpatched-php-and-kernel-flaws-give-attackers-root-on-palo-alto-firewalls","Unpatched PHP and Kernel Flaws Give Attackers Root on Palo Alto Firewalls","A China-linked threat group chained two PHP2Shell vulnerabilities with a Linux kernel privilege escalation flaw to gain root access to at least 25 Palo Alto Networks firewalls, demonstrating how unpatched vulnerabilities in critical network infrastructure can be combined for maximum impact. The attack succeeded because patches were available yet not applied in time, leaving internet-facing firewalls — devices whose primary purpose is protection — as the most exposed targets. With over 22.6 million vulnerable PHP instances still exposed, the attack surface remains enormous. This incident underscores that security appliances are not exempt from patching discipline and must be treated as high-priority assets in any vulnerability management program.",[167,168,169,170,171,172,173],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":175,"PCI DSS Requirement 6":176,"MITRE ATT&CK T1566: Phishing":177,"NIST SP 800-53 SI-2: Flaw Remediation":178,"OWASP A06:2021 Vulnerable and Outdated Components":179,"CIS Control 7: Continuous Vulnerability Management":180,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":181},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices; operators of critical network infrastructure such as these firewalls are obligated to patch promptly and would face liability for the delayed remediation seen here.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities by installing applicable security patches in a timely manner; any cardholder-data-adjacent environment using these Palo Alto firewalls would be in direct violation by leaving CVE-2026-109618 and CVE-2026-109619 unpatched.","While not phishing-based, the chained exploit technique — using PHP2Shell for initial access followed by kernel privilege escalation — maps to the broader ATT&CK exploitation chain; tracking T1190 (Exploit Public-Facing Application) alongside privilege escalation techniques (T1068) would have provided detection coverage for this exact attack pattern.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner — a mature flaw remediation process applied to PAN-OS would have prioritized and deployed the available patches before the China-linked group began its campaign.","The attack exploited known, CVE-numbered flaws in PHP components running on production firewalls — exactly the scenario A06 addresses, where failure to track and update components leads to compromise.","Patches for the exploited PHP2Shell CVEs were available yet not applied; a continuous vulnerability management process with defined remediation deadlines would have closed these flaws before active exploitation reached 25 firewalls.","This control mandates timely identification and remediation of technical vulnerabilities in systems, including security appliances; applying it to the firewall estate would have ensured the PAN-OS patch was tracked and applied within a risk-defined timeframe."]