- Palo Alto Networks warned that attackers are actively exploiting the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) against internet-exposed management interfaces.
- The critical flaws, which allow unauthenticated remote code execution, are being chained by a suspected China-nexus group with a Linux kernel bug called Fragnesia to root servers.
- CISA has added the related privilege escalation vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply fixes by October 31.
Palo Alto Networks on Wednesday warned that threat actors are actively exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. “Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet,” the company stated.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), allow unauthenticated remote code execution on affected PHP versions patched by the PHP Foundation on October 21. Consequently, Israeli cybersecurity firm Dream observed a suspected China-nexus threat actor weaponizing these flaws with a local privilege escalation bug in the Linux kernel, tracked as Fragnesia (CVE-2026-46300), to root 25 servers across the U.S., Japan, Taiwan, and South Korea.
Among those were three systems belonging to a U.S. government-affiliated environment. “The attacker then launched attacks against Active Directory,” Dream noted, adding that recovered artifacts confirm credential extraction and directory enumeration.
The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add CVE-2026-46300 to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply fixes by October 31. “This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP web shells and run commands as root,” CISA said. Palo Alto Networks noted the risk is highest on PAN-OS when access to the management interface is allowed from external IP addresses on the internet.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- CFTC Chair: AI agents could launch memecoins, raising regulatory questions
- Google’s Registered App Stores Program Enables One-Tap Installs
- SK Hynix posts record profit; memory supply sold out to 2030
- Fed holds rates steady at 3.75%-4%, signals fewer meetings
- SpaceX insider stock unlocks to surpass $1 trillion by 2027
