Overview
- Late October attackers used PHP2Shell, two critical PHP engine flaws tracked as CVE-2026-109618 and CVE-2026-109619, chained with the Fragnesia Linux kernel privilege‑escalation bug (CVE-2026-46300) to gain root and install persistent webshells in under 15 minutes.
- Cybersecurity firm Dream reported the campaign and Palo Alto Networks Unit 42 independently verified the toolchain and results, saying only about 0.02% of its global installed base had internet‑exposed management interfaces and affected customers have been contacted.
- The intrusions rooted 25 PAN-OS servers across the United States, Japan, Taiwan and South Korea and gave attackers persistent access to a US government‑affiliated firewall manager that could expose managed firewall configs, credentials and Active Directory connectivity.
- Telemetry shows mass scanning of millions of exposed PHP instances but successful breaches were limited and appliance‑specific, with observers reporting few confirmed compromises of common web platforms such as WordPress.
- Authorities and vendors have released fixes and mitigations and defenders are urged to apply PAN-OS patches, restrict or isolate internet‑facing management interfaces, deploy virtual patching or WAF rules, and hunt logs and memory for pre‑patch intrusions because remediation is complicated by embedded or end‑of‑life PHP and required service restarts.