#Palo-Alto-Networks

New this week on PHP2Shell, the two critical PHP flaws patched on October 21: on Monday, October 26, the US Cybersecurity and Infrastructure Security Agency (CISA) added both (CVE-2026-109618 and CVE-2026-109619) to its catalog of exploited vulnerabilities and gave federal agencies until October 29 to patch, The Register reports. A Perplexity researcher logged successful shell commands on honeypots, while Sophos and Palo Alto Networks walked back earlier claims of successful attacks.

On October 28, Israeli security company Dream said it had recovered the tools of a suspected Chinese, apparently AI-assisted campaign that chained a custom PHP2Shell exploit with a Linux kernel bug (Fragnesia, CVE-2026-46300) to get root on 25 Palo Alto Networks PAN-OS firewalls and management servers in the US, Japan, Taiwan and South Korea. From a US government-affiliated firewall, Dream says, the attackers moved into the internal network and went after Active Directory. Palo Alto's Unit 42 independently verified the tooling, and Palo Alto is releasing fixed PAN-OS versions.

Admins are told to move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and to keep management interfaces off the internet.

Palo Alto Networks announced Unit 42 Continuous Frontier AI Defense, a service that uses multiple frontier and open-weight AI models to continuously assess web applications, APIs and cloud infrastructure.

The system is intended to identify attack paths and vulnerabilities and provide remediation guidance, including code-level fixes and virtual patching.

Why it matters

AI is moving onto both sides of the security equation. Continuous machine-driven testing could shorten the time between vulnerability introduction and discovery—but it also increases the importance of scope controls and safe autonomous testing, especially after recent agent-boundary failures.