PHP2Shell moves from panic to real attacks: CISA confirms exploitation, and researchers trace 25 rooted firewalls
The Register lays out what is confirmed and what was walked back; Dream's report shows a full intrusion step by step.
New this week on PHP2Shell, the two critical PHP flaws patched on October 21: on Monday, October 26, the US Cybersecurity and Infrastructure Security Agency (CISA) added both (CVE-2026-109618 and CVE-2026-109619) to its catalog of exploited vulnerabilities and gave federal agencies until October 29 to patch, The Register reports. A Perplexity researcher logged successful shell commands on honeypots, while Sophos and Palo Alto Networks walked back earlier claims of successful attacks.
On October 28, Israeli security company Dream said it had recovered the tools of a suspected Chinese, apparently AI-assisted campaign that chained a custom PHP2Shell exploit with a Linux kernel bug (Fragnesia, CVE-2026-46300) to get root on 25 Palo Alto Networks PAN-OS firewalls and management servers in the US, Japan, Taiwan and South Korea. From a US government-affiliated firewall, Dream says, the attackers moved into the internal network and went after Active Directory. Palo Alto's Unit 42 independently verified the tooling, and Palo Alto is releasing fixed PAN-OS versions.
Admins are told to move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and to keep management interfaces off the internet.
-
PHP
After exploring CISA confirms PHP2Shell under attack as researchers clock successful exploits, why one language's bug reaches so far is clearer from PHP.
An overview of PHP, the general-purpose scripting language geared toward web development that much of the web still runs on.
Wikipedia · Wade · 5 min
0