TECH NEWS

PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

https://www.securityweek.com/wp-content/uploads/2026/10/php-exploit-code.webp

Threat actors have been hammering servers vulnerable toPHP2Shellfor over a week, but only a few successful compromises have been confirmed to date.

Standing out are Palo Alto Networks firewalls, which have been rooted by a China-linked hacking group in attacks chaining PHP2Shell with the Fragnesia kernel privilege escalation bug.

Assisted by AI, the hackers chained two separate exploits: one specifically targeting the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 on Palo Alto Networks’ PAN-OS devices, and another one for Fragnesia to deploy webshells with root privileges.

Cybersecurity outfit Dream flagged the campaign earlier this week, noting that at least 25 firewalls out of a pool of hundreds were hacked. Palo Alto Networks has since confirmed the findings.

“Dream Research has reported a campaign in which attackers chained PHP2Shell with a Linux kernel privilege-escalation vulnerability to gain root access. Unit 42 has independently verified the same attacker’s tooling and confirmed the...

Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE

Read more

https://cdn.mos.cms.futurecdn.net/X5DPDeFcG3TSkqdJMgSU3U-970-80.jpg

Chinese hackers build PHP2SHELL exploit, use it to root 25 servers, breach US government-affiliated firewalls

* Researchers report the first confirmed PHP2Shell compromises, targeting organizations linked to the US government * Attackers chained PHP2Shell with a Linux privilege-escalation flaw to gain root access and persistence * Breaches progressed from initial compromise to Active Directory attacks within minutes, underscoring patching urgency We now have confirmation of the first successful