Attackers Chain PHP Flaws to Seize Firewalls
Confirmed exploitation of PHP2Shell and a Linux kernel flaw shows how web-layer weaknesses can escalate to full system control.
Updated on Nov. 5, 2026 in Cybersecurity
Live Poll
Do you trust your bank to keep your data safe from hackers?
Singapore's Cyber Security Agency has reported active exploitation of PHP2Shell vulnerabilities against Palo Alto Networks firewalls, with attackers combining them with a Linux kernel flaw to gain root-level privileges. The exploitation is confirmed in operation, not a research demonstration.
Why it matters
The attacks targeted internet-exposed management interfaces, the administrative doors to network security hardware. Chaining a PHP flaw with a kernel flaw shows how a single web-layer weakness can escalate into full control of the underlying system.
The Netherlands' National Cyber Security Centre is tracking 948 software products for potential PHP2Shell exposure, of which 215 are classified as vulnerable, 185 have fixes available and 240 depend on the PHP version in use. Ninety-three products remain under investigation, so the vulnerable count may change.
The players
Singapore Cyber Security Agency
Singapore's national body responsible for cybersecurity, which issued the alert on active PHP2Shell exploitation against Palo Alto Networks firewalls.
Palo Alto Networks
A cybersecurity company whose firewall products are the primary targets named in the reported exploitation campaign.
Microsoft
A technology company whose October 30 advisory confirmed that both PHP2Shell flaws were being actively exploited.
Wiz Research
The cloud security research team that discovered the PHP2Shell vulnerabilities.
The details
PHP2Shell is a set of flaws in PHP, the scripting language that many web applications run on, and it is tracked as CVE-2026-109618 and CVE-2026-109619. Attackers reached the management interfaces of Palo Alto Networks firewalls, the web-based control panels administrators use to configure the devices, and then paired the PHP flaws with CVE-2026-46300, a Linux kernel flaw dubbed Fragnesia. The kernel is the core of the operating system, so the combination let attackers obtain root-level privileges, meaning unrestricted control of the device.
Timeline
October 21, 2026: PHP2Shell vulnerabilities disclosed.
October 26, 2026: Flaws added to CISA's Known Exploited Vulnerabilities catalog.
October 30, 2026: Microsoft confirmed in an advisory that both flaws were being actively exploited.
November 3, 2026: Singapore's Cyber Security Agency issued a security alert on the exploitation.
The Tech Race
The addition to CISA's Known Exploited Vulnerabilities catalog five days after disclosure follows the standard path for flaws confirmed as actively exploited. The chaining of a PHP web flaw with a Linux kernel flaw illustrates how defenders now must track weaknesses across the full software stack rather than one product at a time.
Organizations running affected Palo Alto Networks, Cisco, Citrix, F5 or Siemens systems, or PHP-based web applications, face the most immediate exposure. Applying the corrected PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35, along with vendor patches, is the step that closes the gap.
The takeaway
Administrators should confirm whether their management interfaces are exposed to the internet and whether their PHP version is among the corrected releases. Watch whether the 93 products still under investigation are classified in the coming weeks, which will settle the final count of vulnerable systems.
Further reading
For broader context on how attacks like this unfold, see the Cybersecurity section.
Source note: This article includes information reported by CUToday.
Live Poll
Do you trust your bank to keep your data safe from hackers?
