CERT24PHP2Shell attacks root Palo Alto firewalls but fail against WordPressLoading data…
CERT24Threat Observatory
Period

PHP2Shell attacks root Palo Alto firewalls but fail against WordPress

Attackers have been targeting servers vulnerable to PHP2Shell for more than a week. Palo Alto Networks confirmed a campaign in which PAN-OS devices with internet-exposed management interfaces were attacked by chaining PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 with the Fragnesia Linux kernel privilege-escalation bug. At least 25 firewalls from a pool of hundreds were compromised. As of October 28, no WordPress site compromise via PHP2Shell had been identified.

← Back to intelligence

PHP2Shell attacks root Palo Alto firewalls but fail against WordPress

Attackers have been targeting servers vulnerable to PHP2Shell for more than a week. Palo Alto Networks confirmed a campaign in which PAN-OS devices with internet-exposed management interfaces were attacked by chaining PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 with the Fragnesia Linux kernel privilege-escalation bug. At least 25 firewalls from a pool of hundreds were compromised. As of October 28, no WordPress site compromise via PHP2Shell had been identified.