Weekly Threat Bulletin – November 4th, 2026

Table of Contents

PHP2Shell RCE Vulnerabilities (CVE-2026-109618/19) and Fragnesia (CVE-2026-46300) Chained to Compromise Palo Alto PAN-OS Firewalls

Threat actors have compromised 25 Palo Alto Networks PAN-OS systems, including 24 perimeter firewalls and one internal management server, by chaining the critical PHP2Shell remote code execution (RCE) vulnerabilities with the Fragnesia Linux kernel privilege escalation flaw. The PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS 4.0 rating of 9.2, exploit PHP's session-upload handling and heap allocations to bypass address space layout randomization (ASLR) and execute arbitrary code via the `system()` function. In this campaign, the attackers utilized a custom exploit tailored to the uniform PHP 8.0.30 build of the PAN-OS appweb management server, subsequently leveraging the Fragnesia flaw (CVE-2026-46300) to escalate privileges to root. Upon gaining access, the operators established a persistent reverse SSH tunnel into a United States government-affiliated environment, allowing them to pivot internally and harvest directory-service credentials. To mitigate these threats, organizations must apply vendor-supported PAN-OS remediations, update standalone PHP deployments to versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or temporarily disable `session.upload_progress.enabled` to block the upload-progress attack path.

Severity: Critical

Threat Details and IOCs

Malware:	ArcBridge, ARTEX, Bady, Bash0day, Bashlite, BASHLITE, BlackLotus, BlackX, Bladabindi, Brain Cipher, BridgeHead, Candiru, Code Red, CoolClient, DevilsTongue, Everest, Everest Ransomware, Gafgyt, Gentlemen, Gentlemen Ransomware, Hakai, Hive, HOOKEDGE, Icarus macOS, ICMacOS, KGB RAT, Lizkebab, LockBit 3.0, LockBit Black, Masuta, Miasma, Mini Shai-Hulud, Miori, Mirai, Moobot, NightLedger, NjRAT, NodeRabbit, Okiru, OMG, Omni, Owari, PEERSTITCH, PollCat, Potassium, SafePay, Sapphire, Satori, Settra, Sha1-Hulud: The Second Coming, Shai-Hulud, Shai-Hulud 2.0, SQL Slammer, Storm-2697, The Gentlemen, Torlus, Wana Decrypt0r, WannaCry, WannaCrypt, WannaCryptor, Wcry, Wicked
CVEs:	CVE-2019-11043, CVE-2020-3259, CVE-2021-44228, CVE-2023-20269, CVE-2023-27532, CVE-2023-34362, CVE-2023-4966, CVE-2024-40711, CVE-2024-40766, CVE-2024-4577, CVE-2025-0108, CVE-2026-109618, CVE-2026-109619, CVE-2026-110264, CVE-2026-111497, CVE-2026-111943, CVE-2026-113470, CVE-2026-115560, CVE-2026-1731, CVE-2026-46300, CVE-2026-8467, CVE-2026-92392, CVE-2026-97631
Technologies:	ABB Manufacturing Execution System, Adobe Commerce, AlmaLinux, Alpine Linux, Amazon Elastic Beanstalk, Amazon Lightsail, Amazon Linux, Amazon Web Services, Apache httpd, Apache httpd mod_php, Apple iOS, Apple macOS, ASUSTOR NAS, AWS Lambda, Baota Panel, Belden NetModule NRSW, BeyondTrust Privileged Access Management, BeyondTrust Remote Support, B&R Industrial Automation APROL, Buffalo, Bun, Canonical Ubuntu, Cisco Adaptive Security Appliance, Cisco AppDynamics APM, Cisco Catalyst Center, Cisco Firepower Threat Defense, Cisco Identity Services Engine, Cisco SD-WAN, Cisco Vulnerability Management, Cisco Webex, Citrix NetScaler, ClawHub OpenClaw, Cleo Harmony, Cloudflare, CloudLinux OS, Composer, containerd, cPanel, cPanel cPanel, cURL, Debian, DirectAdmin, Discuz!, Docker, DokuWiki, Drupal, Electrum, eMudhra, F5 Nginx, FrankenPHP, FreeBSD, GitHub Platform, GitLab, Google Android, Google Brotli, Google Cloud Platform, Google Cloud Run, Google Kubernetes Engine, Hugging Face, Hugging Face Platform, Jeedom, Jenkins, Johnson Controls Illustra, Johnson Controls Visonic PowerManage, Joomla!, Keycloak, Kubernetes, Laravel, lighttpd, Lime Technology Unraid OS, Linux, Linux Kernel, LiteSpeed Web Server, MediaWiki, Microsoft Active Directory, Microsoft Internet Information Services (IIS), Microsoft .NET, Microsoft SharePoint Server, Microsoft Windows, Microsoft Windows Server, MySQL, n8n, NetScaler, Nextcloud, Nginx, Node.js, OpenSSH, Oracle WebLogic Server, Palo Alto Networks Panorama, Palo Alto Networks PAN-OS, Palo Alto Networks WildFire Appliance, Pantheon, PHP, phpBB, PHP-CGI, PHP-FPM, phpMyAdmin, Pixel & Tonic Craft CMS, Plausible Analytics Community Edition, Plesk, Podman, PostgreSQL, Progress Telerik Report Server, Python, Python Package Index, QNAP, QNAP NAS, QNAP QTS, QNAP QuTS hero, Red Hat, Red Hat Enterprise Linux, RoadRunner, Rocky Linux, Schneider Electric EcoStruxure, Schneider Electric EcoStruxure Security Expert, Schneider Electric ProLeiT LINEoptimize, Shopware, Siemens RUGGEDCOM, Siemens RUGGEDCOM APE1808, Smartschool, SonicWall SonicOS, Sophos MyUTM, SUSE Linux, Swoole, Symfony, Synology, TerraMaster NAS, The PHP Group PHP, ThinkPHP, Ubuntu Linux, UGREEN, Veeam Backup & Replication, Western Digital Hard Disk Drive, WHMCS, WooCommerce, WordPress, Yamaha RTX1210, Zeabur
Threat Actors:	Andariel, APT10, APT28, APT38, APT41, Bluenoroff, BronzeRiverside, BRONZESANDCASTLE, ChoiARin, Cicada, Cnvx, DiamondSleet, Everest, FamousChollima, FancyBear, ForestBlizzard, GraniteTaurus, GuardiansOfPeace, HasanBroker, HiddenCobra, Hive, Hogfish, INC, LabyrinthChollima, Lazarus, LazarusGroup, LockBit, Magecart, MenuPass, Potassium, PurpleTyphoon, RedApollo, SaltTyphoon, Settra, StonePanda, Storm-0940, Storm0940, Swallowtail, Thegentlemen, TheShadowBrokers, TraderTraitor, VibeOps, VoltTyphoon, WageMole, WPShellstorm, Zinc
Attacker Countries:	Australia, Brazil, Canada, China, Estonia, France, Germany, Hong Kong, India, Iran, Israel, Japan, Latvia, Madagascar, Malaysia, Moldova, Netherlands, North Korea, Russia, Singapore, South Korea, United States
Attacker IPs:	101[.]128[.]110[.]145, 101[.]133[.]233[.]159, 101[.]36[.]114[.]102, 102[.]207[.]250[.]188, 102[.]210[.]149[.]166, 103[.]114[.]163[.]188, 103[.]147[.]220[.]17, 103[.]149[.]183[.]197, 103[.]151[.]172[.]95, 103[.]204[.]193[.]27, 103[.]21[.]161[.]105, 103[.]216[.]220[.]92, 103[.]77[.]210[.]80, 104[.]219[.]251[.]31, 104[.]243[.]29[.]169, 104[.]248[.]145[.]184, 104[.]26[.]2[.]223, 104[.]28[.]208[.]84, 104[.]28[.]221[.]228, 105[.]156[.]180[.]134, 107[.]150[.]31[.]151, 107[.]189[.]14[.]87, 109[.]120[.]147[.]103, 109[.]56[.]219[.]150, 109[.]71[.]252[.]97, 1[.]1[.]1[.]1, 111[.]14[.]147[.]72, 112[.]66[.]197[.]171, 112[.]66[.]198[.]12, 114[.]26[.]103[.]72, 115[.]96[.]27[.]126, 116[.]251[.]216[.]106, 116[.]251[.]216[.]117, 117[.]203[.]73[.]63, 117[.]55[.]202[.]115, 119[.]59[.]101[.]74, 119[.]63[.]72[.]54, 121[.]127[.]33[.]74, 122[.]10[.]110[.]72, 122[.]10[.]130[.]72, 122[.]10[.]17[.]49, 123[.]25[.]115[.]82, 124[.]122[.]142[.]142, 125[.]181[.]181[.]168, 128[.]90[.]176[.]13, 129[.]153[.]133[.]23, 130[.]12[.]180[.]42, 130[.]12[.]180[.]89, 130[.]94[.]67[.]235, 13[.]140[.]140[.]94, 13[.]216[.]152[.]122, 134[.]122[.]38[.]73, 134[.]199[.]154[.]64, 134[.]209[.]159[.]64, 134[.]209[.]181[.]133, 134[.]209[.]252[.]157, 135[.]136[.]19[.]197, 138[.]199[.]21[.]230, 138[.]199[.]34[.]201, 138[.]199[.]43[.]94, 138[.]68[.]161[.]170, 139[.]162[.]165[.]136, 140[.]82[.]114[.]4, 141[.]98[.]255[.]191, 141[.]98[.]255[.]246, 142[.]93[.]155[.]162, 143[.]246[.]213[.]138, 143[.]246[.]223[.]124, 144[.]172[.]64[.]128, 144[.]217[.]161[.]236, 144[.]31[.]90[.]126, 144[.]48[.]4[.]242, 144[.]91[.]70[.]51, 145[.]239[.]91[.]0, 145[.]255[.]150[.]25, 146[.]190[.]107[.]103, 146[.]70[.]114[.]180, 146[.]70[.]114[.]182, 146[.]70[.]117[.]243, 146[.]70[.]194[.]93, 146[.]70[.]201[.]232, 146[.]70[.]217[.]86, 146[.]70[.]224[.]226, 146[.]70[.]98[.]138, 147[.]175[.]149[.]67, 147[.]182[.]222[.]30, 147[.]182[.]234[.]126, 147[.]78[.]168[.]57, 147[.]78[.]168[.]67, 147[.]78[.]241[.]219, 149[.]102[.]229[.]156, 149[.]102[.]232[.]44, 149[.]102[.]232[.]93, 149[.]28[.]157[.]90, 151[.]241[.]171[.]87, 151[.]253[.]243[.]219, 15[.]189[.]160[.]29, 15[.]204[.]59[.]70, 152[.]233[.]51[.]69, 152[.]237[.]230[.]29, 152[.]42[.]195[.]115, 152[.]42[.]245[.]8, 153[.]75[.]83[.]37, 154[.]26[.]182[.]240, 156[.]146[.]38[.]170, 156[.]225[.]28[.]97, 157[.]230[.]117[.]70, 157[.]245[.]110[.]32, 158[.]173[.]242[.]133, 158[.]173[.]75[.]178, 159[.]223[.]59[.]200, 159[.]26[.]110[.]122, 159[.]26[.]110[.]129, 161[.]132[.]37[.]162, 161[.]184[.]215[.]40, 162[.]35[.]99[.]94, 165[.]22[.]232[.]198, 167[.]17[.]47[.]102, 167[.]235[.]225[.]149, 169[.]150[.]227[.]213, 169[.]58[.]138[.]154, 170[.]187[.]190[.]236, 170[.]205[.]31[.]28, 170[.]62[.]100[.]187, 170[.]62[.]100[.]237, 170[.]64[.]224[.]137, 170[.]64[.]226[.]40, 172[.]166[.]165[.]148, 172[.]206[.]2[.]199, 172[.]234[.]200[.]18, 173[.]194[.]194[.]94, 173[.]249[.]16[.]178, 173[.]249[.]16[.]192, 176[.]124[.]32[.]170, 176[.]4[.]191[.]221, 176[.]65[.]139[.]168, 178[.]104[.]167[.]156, 178[.]249[.]209[.]166, 178[.]249[.]214[.]6, 181[.]215[.]186[.]252, 18[.]136[.]195[.]202, 182[.]2[.]177[.]82, 182[.]2[.]182[.]165, 182[.]2[.]190[.]142, 18[.]225[.]170[.]231, 18[.]234[.]199[.]237, 183[.]241[.]192[.]249, 184[.]73[.]151[.]236, 185[.]130[.]45[.]226, 185[.]131[.]54[.]148, 185[.]157[.]109[.]60, 185[.]161[.]210[.]29, 185[.]177[.]72[.]45, 185[.]196[.]220[.]132, 185[.]199[.]108[.]133, 185[.]203[.]18[.]54, 185[.]207[.]232[.]121, 185[.]213[.]154[.]179, 185[.]225[.]191[.]232, 185[.]235[.]212[.]105, 185[.]242[.]106[.]140, 185[.]252[.]220[.]147, 185[.]65[.]134[.]250, 185[.]65[.]135[.]250, 185[.]82[.]202[.]138, 185[.]82[.]218[.]119, 186[.]22[.]19[.]172, 188[.]166[.]166[.]205, 188[.]80[.]228[.]122, 191[.]217[.]250[.]227, 192[.]140[.]154[.]1, 192[.]169[.]119[.]217, 192[.]177[.]131[.]13, 192[.]253[.]209[.]123, 192[.]9[.]168[.]47, 193[.]29[.]106[.]28, 193[.]47[.]62[.]24, 194[.]156[.]238[.]177, 195[.]245[.]112[.]63, 195[.]88[.]87[.]101, 198[.]200[.]59[.]85, 198[.]41[.]83[.]165, 198[.]41[.]83[.]174, 198[.]44[.]159[.]163, 200[.]119[.]44[.]50, 200[.]141[.]3[.]58, 20[.]200[.]234[.]181, 20[.]204[.]147[.]74, 20[.]24[.]237[.]207, 203[.]189[.]139[.]225, 204[.]76[.]203[.]7, 20[.]61[.]126[.]211, 206[.]188[.]197[.]105, 206[.]245[.]153[.]56, 206[.]71[.]169[.]144, 208[.]115[.]245[.]102, 208[.]115[.]245[.]98, 208[.]115[.]245[.]99, 20[.]87[.]120[.]146, 212[.]30[.]206[.]158, 213[.]201[.]109[.]35, 217[.]160[.]132[.]82, 217[.]60[.]196[.]124, 217[.]60[.]242[.]58, 217[.]60[.]242[.]76, 221[.]14[.]159[.]134, 223[.]178[.]86[.]187, 223[.]181[.]62[.]146, 223[.]252[.]16[.]151, 2[.]27[.]248[.]209, 23[.]106[.]131[.]214, 23[.]165[.]56[.]186, 23[.]226[.]136[.]36, 23[.]234[.]113[.]169, 23[.]234[.]117[.]66, 23[.]238[.]31[.]189, 23[.]26[.]237[.]221, 23[.]27[.]25[.]75, 2409[:]40d2[:]204e[:]4be[:]2a1f[:]f9c9[:]a055[:]e00b, 2[.]59[.]133[.]151, 27[.]100[.]38[.]10, 31[.]182[.]51[.]55, 31[.]223[.]184[.]166, 3[.]144[.]181[.]153, 31[.]56[.]197[.]72, 31[.]56[.]53[.]223, 3[.]37[.]227[.]134, 34[.]136[.]122[.]211, 34[.]146[.]20[.]31, 35[.]154[.]84[.]153, 35[.]255[.]114[.]109, 3[.]68[.]250[.]21, 37[.]10[.]71[.]188, 37[.]19[.]198[.]236, 37[.]19[.]200[.]5, 37[.]27[.]209[.]157, 38[.]180[.]230[.]11, 38[.]180[.]230[.]216, 38[.]180[.]45[.]91, 38[.]60[.]136[.]217, 38[.]60[.]206[.]217, 41[.]223[.]30[.]7, 45[.]115[.]26[.]26, 45[.]134[.]225[.]16, 45[.]136[.]71[.]89, 45[.]148[.]10[.]201, 45[.]148[.]10[.]80, 45[.]156[.]87[.]44, 45[.]198[.]224[.]169, 45[.]198[.]224[.]88, 45[.]225[.]135[.]53, 45[.]39[.]190[.]176, 45[.]78[.]14[.]116, 45[.]83[.]180[.]113, 46[.]101[.]229[.]142, 46[.]205[.]208[.]16, 46[.]7[.]145[.]54, 47[.]100[.]125[.]108, 47[.]250[.]155[.]133, 49[.]43[.]128[.]164, 5[.]112[.]76[.]18, 51[.]143[.]62[.]244, 5[.]161[.]255[.]209, 5[.]175[.]189[.]76, 5[.]189[.]184[.]114, 52[.]17[.]252[.]187, 52[.]250[.]54[.]233, 5[.]231[.]118[.]119, 52[.]53[.]131[.]214, 52[.]53[.]211[.]104, 5[.]255[.]11[.]134, 5[.]255[.]114[.]109, 5[.]34[.]220[.]134, 54[.]154[.]150[.]2, 54[.]169[.]109[.]7, 57[.]129[.]80[.]197, 58[.]221[.]60[.]160, 63[.]186[.]150[.]111, 64[.]111[.]92[.]102, 64[.]227[.]149[.]251, 67[.]205[.]129[.]138, 68[.]232[.]175[.]240, 72[.]251[.]215[.]19, 74[.]208[.]242[.]33, 75[.]119[.]143[.]189, 77[.]239[.]124[.]121, 77[.]243[.]184[.]207, 77[.]37[.]49[.]40, 77[.]90[.]185[.]20, 77[.]91[.]113[.]125, 78[.]47[.]85[.]99, 79[.]110[.]49[.]21, 79[.]193[.]197[.]168, 81[.]28[.]4[.]17, 82[.]221[.]101[.]119, 83[.]147[.]13[.]219, 83[.]21[.]173[.]138, 85[.]104[.]86[.]24, 85[.]11[.]163[.]243, 85[.]11[.]167[.]104, 85[.]11[.]167[.]243, 85[.]11[.]187[.]35, 85[.]11[.]190[.]112, 85[.]121[.]179[.]129, 87[.]121[.]84[.]174, 88[.]119[.]167[.]239, 8[.]8[.]8[.]8, 89[.]125[.]59[.]156, 89[.]32[.]41[.]16, 89[.]32[.]41[.]50, 89[.]37[.]63[.]146, 89[.]37[.]63[.]204, 89[.]37[.]63[.]248, 89[.]37[.]63[.]57, 90[.]155[.]6[.]87, 91[.]90[.]123[.]25, 92[.]118[.]112[.]100, 92[.]88[.]170[.]153, 94[.]130[.]216[.]171, 94[.]154[.]42[.]149, 94[.]154[.]43[.]100, 94[.]154[.]43[.]149, 94[.]154[.]43[.]185, 94[.]154[.]43[.]187, 94[.]154[.]43[.]189, 94[.]154[.]43[.]219, 94[.]154[.]43[.]222, 94[.]154[.]43[.]7, 95[.]216[.]5[.]90, 95[.]217[.]164[.]124, 95[.]217[.]98[.]37, 95[.]41[.]54[.]130, 96[.]126[.]130[.]81, 98[.]80[.]11[.]91, 98[.]98[.]47[.]154
Attacker Emails:	administrator@chenzicccc, kkkkevin777@tutamail[.]com, theudinhthi421@gmail[.]com
Attacker Domains:	1x0[.]is, analytics[.]convertr[.]app[.]br, anl[.]is, antiddos-protection[.]net, attacker[.]com, blz[.]is, botlesscucks[.]st, calif[.]io, discord[.]com, dv-g3b-aaa-emudhra[.]we-have-a-problem[.]com, dv-g3b-emudhra[.]we-have-a-problem[.]com, emudhra[.]we-have-a-problem[.]com, eqp[.]is, fasthook[.]app, gettingheadfromduckysmom[.]st, github[.]com, godofthunder[.]st, hackattackkaboom[.]botlesscucks[.]st, hik[.]gettingheadfromduckysmom[.]st, jackalsyn[.]com, kk[.]land, kof[.]one, litellm[.]dev, maste[.]mangsud[.]org, metadata[.]google[.]internal, miorl[.]net, nmn[.]is, raw[.]githubusercontent[.]com, shy[.]is, snf[.]is, thunder[.]godofthunder[.]st, tray[.]is, vps3749638[.]trouble-free[.]net, vps-b225fb62[.]vps[.]ovh[.]us, webhook[.]site, www[.]exploit-db[.]com, www[.]litellm[.]dev, xsox[.]diy, xwv[.]is, xxxx[.]oastify[.]com
Attacker URLs:	206[.]188[.]197[.]105[:]9999, 58[.]221[.]60[.]160[:]8000, discord[.]com/api/webhooks/1349318491479605268, discord[.]com/api/webhooks/1349948669419327508, discord[.]com/api/webhooks/1351613753069801583, discord[.]com/api/webhooks/1398562090934993036, discord[.]com/api/webhooks/1414969348262596778, discord[.]com/api/webhooks/1557650706259902495, hxxp[://]15[.]204[.]59[.]70[:]8081/ok33, hxxp[://]15[.]204[.]59[.]70[:]81/s2, hxxp[://]162[.]35[.]99[.]94[:]8080/pwn-T2-honeypot-IP, hxxp[://]162[.]35[.]99[.]94[:]8080/pwn-T2-honeypot-IP >/dev/null, hxxp[://]162[.]35[.]99[.]94[:]8080/pwn-T2-honeypot-IP>/dev/null, hxxp[://]162[.]35[.]99[.]94[:]8090/metabase-rce-139.162.86.33, hxxp[://]162[.]35[.]99[.]94[:]80/ID-$(id -un)-$(hostname), hxxp[://]162[.]35[.]99[.]94[:]80/ID-$(id-un)-$(hostname), hxxp[://]162[.]35[.]99[.]94[:]80/ID-$(id -un)-$(hostname)-$(uname -m), hxxp[://]162[.]35[.]99[.]94[:]80/ID-$(id-un)-$(hostname)-$(uname-m), hxxp[://]162[.]35[.]99[.]94[:]80/PROOF-$(id -un)-$(hostname), hxxp[://]162[.]35[.]99[.]94[:]80/PROOF-$(id-un)-$(hostname), hxxp[://]162[.]35[.]99[.]94[:]80/pwn-T1-honeypot-IP-$(id -un), hxxp[://]162[.]35[.]99[.]94[:]80/pwn-T1-honeypot-IP-$(id-un), hxxp[://]162[.]35[.]99[.]94[:]80/pwn-T2-honeypot-IP, hxxp[://]162[.]35[.]99[.]94[:]80/pwn-T2-honeypot-IP-$(id -un), hxxp[://]162[.]35[.]99[.]94[:]80/pwn-T2-honeypot-IP-$(id-un), hxxp[://]162[.]35[.]99[.]94[:]80/pwn-T3-honeypot-IP, hxxp[://]206[.]188[.]197[.]105[:]8899/proxies.php?key=, hxxp[://]265042758[:]81/b?..., hxxp[://]attacker[.]com/, hxxp[://]jackalsyn[.]com/posts/phpupAssets/php2shell-reup.zip, hxxps[://]1x0[.]is/ws, hxxps[://]analytics[.]convertr[.]app[.]br/js/script.pageview-props.tagged-events.js, hxxps[://]calif[.]io/php2shell/#php-5-4-0-rce, hxxps[://]dv-g3b-aaa-emudhra[.]we-have-a-problem[.]com/, hxxps[://]dv-g3b-emudhra[.]we-have-a-problem[.]com/, hxxps[://]github[.]com/KillaBoi/StealMyBitcoin-PoC, hxxps[://]github[.]com/Neo23x0/process-watcher/releases/latest, hxxps[://]github[.]com/SnailSploit/Claude-Red, hxxps[://]github[.]com/vxcontrol/pentagi, hxxps[://]jackalsyn[.]com/posts/php-up-2026.html, hxxps[://]www[.]exploit-db[.]com/exploits/52704, hxxps[://]x[.]com/IntCyberDigest/status/2112845843938054610/photo/1, hxxp[:]//45.115.26.26:8000/cCmono, hxxp[:]//92.118.112.100/mountpoint, hxxp[:]//92.118.112.100/nfs, hxxp[:]//92.118.112.100/nfs-setup, hxxps[:]//raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt, hxxp[:]//www.litellm.dev/healthcheck
Attacker Hashes:	07353237350c35d6dc2c8f143b649cd07c71f62b, 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486, 1485e14e0f62bc94664eec341cabd275dad7d30b1d496c40ec340c9a0d9f0ba8, 150ae88f0999032e2a6113501d6082f54a3ed98d02427b21a96e773a27d7bf16, 1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e, 1c93ea48fa7ff886a6d81e44869dd7962309e95d01c1561df362b0b18007a562, 23b0d9cb7dce28dbeb9749d2664eacd64474f7a4fab3c152747603c33214e58a, 267a3c8ed021a0a52c29bf076617a0dfd5cd5285202b8d0bd9ad0712110ccae8, 27d926a6708d6769d97d065e7a5a860ab496eab272c03d1cebc55ec71b954fa2, 2d692ee6dcb41c249c55881897b7dec0550b92963e07fccdb11ad655601977c3, 327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917, 40caf199ca1ebe056a74427f8e9db06c66899e33ae09c0ec2769ec70bf6dd8e7, 4a1502affa36d106d5374bf02cf777956eef651176ec8964b26ff90f103dd506, 535b9e298defd3449ba2b10b9828925d3ce344872dcbd9470c0e8db20f0aae83, 567659d699213c360e4598c257c40260cf0d7b1377e4a25851ca3f59a427899c, 57dac347add8738e80393d81c70f5039c9534590f6e8c3ae0eaa258b9d18d6a8, 5e99d6023dce9bb18d845a37fcdbc7ea574fdb20ab8d888ec54c695382d46036, 66bcbc8c2b9d847a1e976e57972e10eac98e9b894cbf30510bff1e8d63efb81f, 675647c9919681e3f6a58c54be30a22942b523e036ee53f0e4fdccf22a506408, 6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a, 6f84cc354b785157983efa8f4b674d2e1d6c3331017f29ff8d51bc43668d4b0f, 74adf2c4eb82776553837d185bae165494288747b43437fd452021a6ff6a93f0, 77afd5bf9c28069616b514a2955dbf52dc62e3b5c5c04c1e86c7a3c3fc5a5156, 7af66c8f35c5fa6b47a539da6dca361d19543d9f62d61e4af891c2802bd5e236, 8e8fc166e6b326d20bb7611d8ef3cee3bd5da46447985312c1492ab0a44d1eb6, 921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae, 9c15dc5a510bf2e8a16c846e61fa35c50ef733b72d4e47b6e8307498a398443c, 9e9280f9e630fc88c2b1e28067e8e8d82a0ad6ef3e203a77e921ccc470ab720b, a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526, a744539cce8295ac07ca70fd5eab9601ef79fb62f142749373d855033fb101e0, aab24fa5ec0df76f731c1ea4bac9fd36aa350eef9a42c33315e485178e1e5892, b498a2683640c983bb069fa2ea9e67cef4a3797d, b61a098fc62a2c2696e196dca78da71a, b6c547e0e9a2bb26607df1521de96f4d5c9adf4621c28b7ab491587b21ae40f2, b8a67dc5173272afd95cd603b2bd7b49bb6e0900af53237096b8caf9fd48ca97, b8e69e39c49c986a6edae77f08b11be1ab1675d4fda6c05dcf0628149eefbd06, bbdd3620a67aedec4b9a68b2c9cc880b6631215e129816aea19902a6f4bc6f41, bbfed53e3bb1f306f4da97d995cf4ae5b73ad081, c1263f68fcb9565dc3b162481574ed6f64ad11436e654751a9da4644352bbcee, c1e81cfbaf7e4cccad7d7f43c1a624b791ba1b7f1d176e224455138604837b4c, c1fc4df4a886aff090471f27a40c29358444b3668257e1b2074577477ba2e36c, c61540651b07f744fa9d43ff326daa7a81c51f90ffdd05b28d1b552ade5320a4, d2d86024e947cbdcecb725e3dae4930579b28f23bff80eedaad6b3f11544bcff, d711a5af5aed48a3b36b98f4fcf52809aebef7a2, dcb4e2b4f6879827222d0bb5efa14dc838357251880302401bc8702bb3085370, e2529d4afa39ae4db2eb05d5176317c906289abf09660c75bdeec43e54c55aa3, e538361aa02f01bb9e00f53d2107eb1369f778203033e08506496a767c0e4abc, e5a9ca54352814eaefc2051013aa424d4e6fd780a2c0d1085fdd35eac392e5c4, e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346, ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7, ff73391d30efd875a28c65178a59cacf6b933f911ae51654b2ffb4d4d3fe850a
Victim Industries:	Advertising Services, Aerospace, Agriculture, Airlines, Architecture, Engineering & Construction (AEC), Arts, Entertainment, and Recreation, Automation, Automotive, Biotechnology, Building Infrastructure, Business Services, Cloud and CDN Providers, Cloud Infrastructure, Commercial Real Estate, Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services, Construction, Construction & Engineering, Consulting Services, Creative & Design, Critical Manufacturing, Cryptocurrency, Data Hosting Services, Decentralized Finance, Defense, E-commerce, Education, Electric Power, Electric Utilities, Energy, Financials, Financial Services, Financial Technology, Food & Beverage, Gaming, Government, Healthcare, Higher Education & Research, Hospitality, Human Resources, Industrial Control Systems, Industrials, Industrial Sector, Information Services, Information Technology, Insurance, Interactive Entertainment, Interactive Media & Services, Internet Infrastructure & Hosting, IT and DevOps, IT Services, Legal & Compliance, Logistics, Managed Service Providers, Manufacturing, Media and Entertainment, Media & Publishing, Multimedia, Nonprofit, Oil & Gas, Online Services, Pharmaceuticals, Professional Services, Public Administration, Public Sector, Real Estate, Retail, Retail & Commerce, Service Providers, Social Media, Software, Sports and Entertainment, Supply Chain, Technology Hardware, Technology & SaaS, Telecommunications, Transportation, Transportation & Logistics, Travel, Travel & Tourism, Utilities, Utilities & Energy, Web Hosting, Wholesale & Distribution
Victim Countries:	Afghanistan, Albania, Algeria, Angola, Argentina, Australia, Austria, Azerbaijan, Bahrain, Bangladesh, Belgium, Bosnia and Herzegovina, Brazil, Bulgaria, Canada, China, Colombia, Croatia, Cyprus, Czech Republic, Denmark, Egypt, Estonia, European Union, Finland, France, Germany, Greece, Hong Kong, Hungary, India, Indonesia, Ireland, Israel, Italy, Japan, Kenya, Kuwait, Kyrgyzstan, Latvia, Lithuania, Luxembourg, Madagascar, Malaysia, Malta, Mexico, Montenegro, Nepal, Netherlands, New Zealand, Nigeria, North Korea, North Macedonia, Norway, Oman, Philippines, Poland, Portugal, Qatar, Romania, Russia, Saudi Arabia, Serbia, Singapore, Slovakia, Slovenia, South Korea, Spain, Sudan, Sweden, Switzerland, Syria, Taiwan, Thailand, Turkey, Uganda, Ukraine, United Arab Emirates, United Kingdom, United States, Venezuela, Yemen

Mitigation Advice

Immediately apply the security updates provided by Palo Alto Networks to remediate the PHP2Shell (CVE-2026-109618, CVE-2026-109619) and Fragnesia (CVE-2026-46300) vulnerabilities on all PAN-OS firewalls.
Apply the latest available kernel security updates to all Linux systems to patch the Fragnesia privilege escalation vulnerability (CVE-2026-46300).
Update all standalone PHP deployments on web servers to a patched version (e.g., 8.2.35, 8.3.36, or newer) to mitigate the PHP2Shell RCE vulnerability.
If immediate patching of PHP servers is not possible, temporarily mitigate the PHP2Shell vulnerability by disabling 'session.upload_progress.enabled' in the php.ini configuration file.
Add all IP addresses listed in the article's IOC table to the firewall blocklist to prevent inbound and outbound communication with known malicious infrastructure.
Initiate threat hunting queries in your SIEM or EDR to search for web server processes (e.g., appweb, httpd, nginx) that have spawned shell processes (e.g., sh, bash, cmd.exe).
Scan all relevant systems, particularly web servers and firewall management servers, for the presence of the files 'panos_rce_poc.py' and 'prce.py'.

Compliance Best Practices

Develop and implement a project to ensure no firewall or network device management interfaces are exposed to the public internet. All management access must be restricted to a secure, internal-only management network, accessible only via VPN or a bastion host.
Implement a default-deny egress traffic policy on the firewall. Create explicit allow rules only for known, required outbound protocols and destinations for servers, especially those in DMZ or management zones.
Review and enhance network segmentation policies to create isolated security zones for critical infrastructure. Enforce strict access control lists (ACLs) between the internet-facing DMZ, internal management networks, and user networks.
Establish a formal vulnerability management program that includes automated asset discovery, continuous vulnerability scanning, risk-based prioritization of findings, and defined Service Level Agreements (SLAs) for remediation.

Sources

https://about.gitlab.com/blog/find-vulnerability-blast-radius-with-gitlab-orbit/

https://about.gitlab.com/blog/gitlab-helps-remediate-critical-php-flaws/

https://arcticwolf.com/resources/blog/arctic-wolf-labs-finding-prioritizing-and-patching-php2shell-exposure/

https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/

https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/

https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/

https://aws.amazon.com/security/security-bulletins/2026-143-aws/

https://blog.checkpoint.com/ai-security/php2shell-one-in-ten-organizations-impacted-as-europe-bears-the-brunt/

https://blog.checkpoint.com/security/php2shell-what-we-know-about-the-leaked-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

https://blog.nviso.eu/2026/10/23/php2shell-operational-guidance/

https://blog.polyswarm.io/millions-of-php-servers-face-rce-risk-as-php2shell-exploitation-attempts-emerge

https://blog.qualys.com/misc/2026/10/25/cant-patch-php2shell-yet-build-a-stopgap-with-the-controls-you-own

https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities

https://blog.securelayer7.net/php-rce-cve-2026-109618-109619/

https://blog.talosintelligence.com/two-critical-rces-in-php-core/

https://buaq.net/go-449712.html

https://buaq.net/go-449718.html

https://buaq.net/go-449721.html

https://buaq.net/go-449743.html

https://buaq.net/go-449765.html

https://buaq.net/go-449801.html

https://buaq.net/go-449807.html

https://buaq.net/go-449818.html

https://buaq.net/go-449830.html

https://buaq.net/go-449832.html

https://buaq.net/go-449833.html

https://buaq.net/go-449835.html

https://buaq.net/go-449842.html

https://buaq.net/go-450028.html

https://buaq.net/go-450046.html

https://buaq.net/go-450078.html

https://buaq.net/go-450098.html

https://buaq.net/go-450100.html

https://buaq.net/go-450120.html

https://buaq.net/go-450123.html

https://buaq.net/go-450242.html

https://buaq.net/go-450264.html

https://buaq.net/go-450279.html

https://buaq.net/go-450291.html

https://buaq.net/go-450353.html

https://buaq.net/go-450647.html

https://buaq.net/go-451076.html

https://buaq.net/go-451082.html

https://buaq.net/go-451100.html

https://buaq.net/go-451106.html

https://buaq.net/go-451288.html

https://buaq.net/go-451566.html

https://ciso.economictimes.indiatimes.com/news/vulnerabilities-exploits/two-critical-php-flaws-trigger-global-cybersecurity-alert/135160424

https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619/

https://craftcms.com/blog/craft-cloud-and-php2shell

https://cybelangel.com/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/

https://cyberhoot.com/advisory/emergency-advisory-critical-php-flaws-php2shell-need-action-today/

https://cyberinsider.com/php-releases-emergency-fixes-for-critical-php2shell-vulnerabilities/

https://cyberpress.org/cisa-warns-php2shell-flaws/

https://cyberpress.org/cloudflare-detects-attack-php-flaws/

https://cyberpress.org/critical-php2shell-flaws/

https://cyberpress.org/critical-php-rce-vulnerabilities/

https://cyberpress.org/hackers-exploit-php2shell-vulnerabilities/

https://cyberpress.org/hackers-exploit-php2shell-vulnerabilities-2/

https://cyberpress.org/php2shell-attacks-attempt-mirai/

https://cyberpress.org/php2shell-exploits-predate-patches/

https://cyberpress.org/php2shell-exploits-target-websites/

https://cyberpress.org/php-8-5-12-fixes-critical-flaws-that-could-let-hackers-take-over-servers-without-login/

https://cyberpress.org/php-fixes-critical-php2shell-flaws/

https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/

https://cyberveille.esante.gouv.fr/alertes/php-cve-2026-109618-2026-10-21

https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers

https://eclecticlight.co/2026/10/29/do-you-ever-use-curl-how-recent-vulnerabilities-could-affect-you/

https://eliastaylor.com/noexploit/

https://exploit-intel.com/vuln/CVE-2026-109619

https://financefeeds.com/critical-php-vulnerabilities-trigger-global-security-alert-as-slowmist-warns-crypto-platforms/

https://financefeeds.com/crowdstrike-stock-prediction-239-34-bull-439-39-bear-216-93/

https://financefeeds.com/php2shell-what-is-real-banks-1-6-trillion/

https://gbhackers.com/cloudflare-warns-of-active-exploitation-attempts/

https://gbhackers.com/hacker-demonstrates-php-remote-code-execution-in-stealmybitcoin/

https://gbhackers.com/hackers-exploit-php2shell-rce-vulnerabilities/

https://gbhackers.com/hackers-exploit-php2shell-vulnerabilities/

https://gbhackers.com/php2shell-exploit-scripts/

https://gbhackers.com/php-fixes-two-critical-rce-vulnerabilities/

https://gbhackers.com/php-rce-vulnerabilities/

https://gbhackers.com/php-vulnerabilities/

https://gbhackers.com/two-critical-php-rce-vulnerabilities/

https://hackread.com/426-android-ios-apps-linked-php2shell-backend-risks/

https://hackread.com/cisa-confirm-php2shell-exploit-federal-agencies-patch/

https://hackread.com/offsec-launches-free-php2shell-lab-following-critical-vulnerability-discovery/

https://hackread.com/php-releases-emergency-fixe-php2shell-vulnerabilities/

https://horizon3.ai/attack-research/attack-blogs/php2shell-exposure-exploitability/

https://horizon3.ai/attack-research/vulnerabilities/cve-2026-109618-cve-2026-109619/

https://isc.sans.edu/diary/rss/33440

https://jfrog.com/blog/are-we-exposed-what-cisos-need-to-know-about-their-software-risk/

https://kb.cert.org/vuls/id/763488

https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/

https://labs.k7computing.com/index.php/security-advisory-php2shell-critical-remote-code-execution-vulnerabilities-affecting-php-servers/

https://linuxiac.com/critical-php-vulnerabilities-allow-remote-code-execution/

https://medium.com/codetodeploy/php2shell-eight-servers-audited-from-a-chat-window-e8520e8629bd?source=rss-8eb17886caac------2

https://meterpreter.org/critical-php-vulnerabilities-emergency-patch/

https://meterpreter.org/php2shell-aslr-bypass-rce/

https://nsfocusglobal.com/php-remote-code-execution-vulnerability-cve-2026-109618-cve-2026-109619-advisory/

https://orca.security/resources/blog/php2shell-php-rce-vulnerabilities/

https://orca.security/resources/blog/php2shell-what-this-week-tells-us-about-the-web-we-built/

https://osintteam.blog/php2shell-exploring-the-impact-of-cve-2026-109618-and-cve-2026-109619-14a9f97d7c2c?source=rss----2983bc435765---4

https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/

https://proglib.io/p/php-servery-atakovali-eshche-do-patchey-zakryty-dve-kriticheskie-dyry-2026-10-22

https://research.hisolutions.com/2026/10/php2shell-kritische-rce-schwachstellen-in-php/

https://rhisac.org/general-blog/update-cisa-confirms-php2shell-exploitation-added-to-kev/

https://rhisac.org/general-blog/update-php-releases-critical-php-security-update-to-mitigate-vulnerabilities/

https://sansec.io/research/php2shell

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1

https://seceon.com/php2shell-critical-php-vulnerabilities-put-web-applications-at-risk/

https://seclists.org/fulldisclosure/2026/Oct/38

https://seclists.org/fulldisclosure/2026/Oct/51

https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/

https://securereading.com/php2shell-exploitation-before-patch-amazon/

https://securereading.com/php2shell-vulnerability-critical-php-rce-patch/

https://securityboulevard.com/2026/10/cisa-says-php2shell-flaw-under-attack-as-reports-of-more-come-in/

https://securityboulevard.com/2026/10/i-survived-the-php-vulnerability-and-all-i-got-was-this-t-shirt/

https://securityboulevard.com/2026/10/php2shell-in-practice-exploitable-conditional-and-hard-to-mass-exploit/

https://securitybrief.asia/story/palo-alto-warns-on-22-million-exposed-php-instances

https://securitybrief.asia/story/qualys-offers-free-help-after-php2shell-flaw-disclosure

https://securitybrief.asia/story/urgent-php-flaws-expose-websites-to-remote-attacks

https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/

https://securityonline.info/gcore-makes-enterprise-security-bundle-free-for-public-agencies-until-end-of-the-year/

https://securityonline.info/offsec-launches-free-php2shell-lab-following-critical-vulnerability-discovery/

https://securityonline.info/pan-os-php2shell-cve-2026-109618/

https://securityonline.info/php2shell-affected-products-list/

https://securityonline.info/php2shell-cisa-kev-confirmed-rce-dprk/

https://securityonline.info/php2shell-exploited-poc-public/

https://securityonline.info/php2shell-exploit-fragnesia-roots-firewalls/

https://securityonline.info/php-rce-vulnerabilities-cve-2026-109618-109619/

https://securityonline.info/php-security-release-cve-2026-109618-109619/

https://securityonline.info/qnap-php2shell-vulnerabilities-qts/

https://security.paloaltonetworks.com/CVE-2026-109618

https://securityreviewmag.com/?p=30964

https://securityreviewmag.com/?p=30978

https://slowmist.medium.com/php-unveils-critical-internet-wide-vulnerabilities-how-can-web3-patch-its-off-chain-weaknesses-511a97c26b0c?source=rss-4ceeedda40e8------2

https://socprime.com/blog/cve-2026-109618-cve-2026-109619-analysis/

https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/

https://socradar.io/blog/php2shell-exploit-tooling-attacker-server/

https://socradar.io/blog/php2shell-weaponized-japanese-real-estate-extortion/

https://sploitus.com/exploit?id=023BD0DA-4BE5-5E57-A45D-0AA7B6A14CD2

https://sploitus.com/exploit?id=0AA0F832-E345-5668-A730-14A86E32FA9B

https://sploitus.com/exploit?id=14FCA4A2-AE52-5D6D-ADDB-2D80C9C0DF2A

https://sploitus.com/exploit?id=16C01B4E-8F21-54FC-8FB3-BB9B26689D52

https://sploitus.com/exploit?id=1771B542-3D2A-582D-9209-FBCE35261CEE

https://sploitus.com/exploit?id=1C0FD057-CD1D-513A-8F88-559914195741

https://sploitus.com/exploit?id=1C8F3A7B-6558-58E4-9FE2-826A55F85CD4

https://sploitus.com/exploit?id=1F0DDD9C-4094-50B9-88A4-0701478A15CC

https://sploitus.com/exploit?id=2088F58D-E127-5539-B2CE-232A1CA6099D

https://sploitus.com/exploit?id=2346B117-93CB-5E85-985A-E91D8C126D60

https://sploitus.com/exploit?id=35ADB421-0F04-58FA-AE51-7255E8A37126

https://sploitus.com/exploit?id=36490DFF-D351-56CB-B9DC-0221015264C7

https://sploitus.com/exploit?id=3CFA3E05-452F-5B76-B1AA-1315AFBE1637

https://sploitus.com/exploit?id=3FAEDF73-8B97-5613-BA92-16A94D3E0347

https://sploitus.com/exploit?id=63C58C1E-ED4E-5223-BC8A-BE10179F45E4

https://sploitus.com/exploit?id=6624FF6D-16F7-500F-BDCC-4188C34443F1

https://sploitus.com/exploit?id=71261010-5FD5-5205-85E8-127373511FA8

https://sploitus.com/exploit?id=8980D3A8-6C4E-59C4-BF1D-E999F0C372BD

https://sploitus.com/exploit?id=90B92B4D-29EB-5AAC-AAA8-9BAD710AF7B2

https://sploitus.com/exploit?id=A2689A19-A051-5F21-9D1B-B81E8A7D9BBD

https://sploitus.com/exploit?id=B3097465-E434-5A24-8534-DACE5DE1575C

https://sploitus.com/exploit?id=B92A4DD8-2DAF-55B4-BC51-CBD39E25AFD8

https://sploitus.com/exploit?id=D0485B60-0F32-5228-ABB1-22B5556D7308

https://sploitus.com/exploit?id=D49A88AD-5B77-5CEB-8EBD-D86FBAE369CC

https://sploitus.com/exploit?id=D738E0FC-E0DB-53AF-8D7F-486622671AC5

https://sploitus.com/exploit?id=DD1D4BA4-268C-5618-A748-F75EBD1499D2

https://sploitus.com/exploit?id=E6E9C22F-AFD7-518B-863C-4EF87F0ACF2F

https://sploitus.com/exploit?id=EDD1CBA1-690E-5839-8A51-537D5FAFDB85

https://sploitus.com/exploit?id=F512A831-C6B6-5E35-9BA4-F86B28EF1206

https://sploitus.com/exploit?id=FD9A8273-236B-5584-A2E0-DA5071AC47BD

https://sploitus.com/exploit?id=KS:EXPLOITS-MULTI-HTTP-PHP2SHELL_CVE_2026_109618_RCE

https://techcrunch.com/2026/10/21/php-armageddon-openai-googles-wiz-find-ancient-holes-panicking-the-internet/

https://techcrunch.com/2026/10/24/php-ocalypse-how-two-critical-web-bugs-almost-broke-the-internet/

https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html

https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html

https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html

https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html

https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html

https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html

https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html

https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html

https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

https://webflow.sysdig.com/blog/php2shell-cve-2026-109618-and-cve-2026-109619-detecting-unauthenticated-remote-code-execution-in-php-core

https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce

https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/

https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/

https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/

https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/

https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/

https://www.catonetworks.com/blog/cato-ctrl-threat-brief-php2shell-protection-at-machine-speed/

https://www.catonetworks.com/blog/cato-ctrl-threat-research-php2shell-exploitation-attempts-in-the-wild/

https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/

https://www.ctfiot.com/314332.html

https://www.ctfiot.com/314351.html

https://www.cyberkendra.com/2026/10/cve-2026-109618-pan-os-panorama-php2shell.html

https://www.cyberkendra.com/2026/10/php2shell-cve-2026-109618-cve-2026-109619.html

https://www.cyberkendra.com/2026/10/php2shell-php-8-5-12-patch-bypass-rce-poc.html

https://www.cyberkendra.com/2026/10/php-cve-2026-109618-cve-2026-109619-rce.html

https://www.darkowl.com/blog-content/php-vulnerabilities-affect-the-darknet-also/

https://www.esecurityplanet.com/news/news-php-critical-security-flaws-emergency-patches/

https://www.esecurityplanet.com/threats/news-black-october-php-patches-security-response/

https://www.esecurityplanet.com/threats/news-php-flaws-european-government-websites-offline-emea/

https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/

https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/

https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/

https://www.hkcert.org/blog/hkcert-warns-of-critical-php2shell-vulnerabilities-businesses-must-immediately-review-and-patch-php-systems-ai-accelerates-cyber-attacks-and-defence-further-shortening-the-response-window-between-vulnerability-disclosure-and-exploitation

https://www.hkcert.org/security-bulletin/php-multiple-vulnerabilities_20261022

https://www.infoblox.com/blog/security/php2shell-is-already-here-how-the-infoblox-platform-helps-uncover-and-mitigate-the-risk/

https://www.infosecurity-magazine.com/news/chinese-us-government-chained-php2/

https://www.infosecurity-magazine.com/news/critical-php-vulnerabilities-leaked/

https://www.infosecurity-magazine.com/news/php2shell-exploitation-attempt/

https://www.intel471.com/blog/testing-a-php2shell-exploit-in-the-era-of-ai-hallucinated-pocs

https://www.kaspersky.com/blog/cve-2026-109618-109619-php-vulnerabilities/56583/

https://www.kaspersky.com/blog/how-to-mitigate-php2shell-at-home/56592/

https://www.lansweeper.com/blog/vulnerability/two-critical-php-vulnerabilities-allow-unauthenticated-remote-code-execution/

https://www.lastwatchdog.com/shared-intel-qa-php2shell-is-no-log4shell-its-danger-has-not-yet-matched-the-alarm/

https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates

https://www.metacurity.com/hack-attempt-knocks-fec-filings-offline-in-campaign-cash-crunch/

https://www.metacurity.com/openai-cuts-off-internet-access-for-top-models-training-following-containment-failures/

https://www.metacurity.com/php2shell-sparks-a-global-patch-panic/

https://www.metacurity.com/php-urges-immediate-patching-as-details-of-two-critical-flaws-reportedly-leak/

https://www.morphisec.com/blog/php2shell-is-hitting-windows-servers-in-the-wild-we-stopped-it/

https://www.netspi.com/blog/executive-blog/critical-vulnerability/php2shell-unauthenticated-rce-on-php-cve-2026-109618-cve-2026-109619/

https://www.php.net/archive/2026.php

https://www.pwndefend.com/2026/10/21/how-likely-is-mass-exploitation-of-wp2shell/

https://www.pwndefend.com/2026/10/21/vulnerabilities-in-php-cve-2026-109618-cve-2026-109619/

https://www.pwndefend.com/2026/10/30/php2shell-activity-update/

https://www.pwndefend.com/2026/10/30/php2shellvibe-ops/

https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation

https://www.safebreach.com/blog/php2shell-cve-2026-109618-cve-2026-109619-safebreach-coverage/

https://www.schneier.com/blog/archives/2026/10/new-serious-php-vulnerabilities-released-and-patched.html

https://www.securityweek.com/china-linked-hackers-exploit-php2shell-to-root-firewalls/

https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/

https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/

https://www.securityweek.com/php2shell-attacks-root-palo-alto-firewalls-but-fail-against-wordpress/

https://www.securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells/

https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/

https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/

https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/

https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/

https://www.sekoia.com/blog/php2shell-was-exploited-before-the-patch-expect-more-of-it

https://www.sonarsource.com/blog/container-scanning-open-beta/

https://www.techradar.com/computing/internet/no-the-internet-isnt-dying-due-to-one-of-the-most-significant-vulnerabilities-of-2026-but-this-is-what-you-need-to-know

https://www.techradar.com/pro/live/php-issues-affect-websites-across-the-world-all-the-latest-updates-and-what-you-need-to-know

https://www.techradar.com/pro/security/chinese-hackers-build-php2shell-exploit-use-it-to-root-25-servers-breach-us-government-affiliated-firewalls

https://www.techradar.com/pro/security/experts-reveal-another-major-php2shell-bug-and-its-not-getting-an-emergency-patch-this-time

https://www.techradar.com/pro/security/php-releases-emergency-fixes-as-some-of-the-worlds-biggest-websites-say-they-were-targeted-by-hackers

https://www.techradar.com/pro/security/php-security-issues-could-also-threaten-your-nas-device-but-not-every-vendor-is-able-to-patch-just-yet

https://www.techradar.com/pro/security/website-admins-across-the-world-bracing-for-impact-following-major-php-flaw-reveal

https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote

https://www.tenable.com/blog/php2shell-one-week-later-why-one-exploit-doesnt-work-everywhere

https://www.tenable.com/blog/php2shell-vulnerability-threat-actor-response

https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749

https://www.theregister.com/cyber-crime/2026/10/27/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits/5305681

https://www.theregister.com/security/2026/10/21/php-devs-publish-critical-bug-fix-as-site-owners-warned-pull-em-offline-if-youre-unpatched/5304519

https://www.theregister.com/security/2026/10/22/php2shell-exploit-bypasses-protections-designed-to-stop-remote-code-execution/5304883

https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840

https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611

https://www.theregister.com/security/2026/10/26/partner-content-no-login-no-app-code-no-warning-what-next/5305336

https://www.theregister.com/security/2026/10/26/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the-flag-contest/5305429

https://www.theregister.com/security/2026/10/28/cisco-open-sources-tool-for-detecting-ai-agents-on-hacking-sprees/5305867

https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456

https://www.upguard.com/blog/php2shell-a-clear-explanation-and-response-framework

https://www.wiz.io/blog/php2shell-exploitation-so-far

https://www.wiz.io/blog/php2shell-php-rce

https://www.zdnet.com/tech/php2shell-php-patch-mitigation-critical-exploit/

https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce

DeadTag Toolkit Leveraged to Deploy Coruna and DarkSword Zero-Click Spyware on iOS Devices via PrestaShop Exploits, Targeting Crypto Wallets

A dark web traffic-brokering toolkit active since spring 2026, known as DeadTag, is generating approximately 135 million monthly visits by acquiring expired ad-industry domains and modifying their embedded tracking tags across thousands of legitimate websites. While most operators use this infrastructure to redirect users to low-level scams, a threat actor group dubbed the "iPhone exploit crew" leverages DeadTag and compromised PrestaShop e-commerce sites to deploy highly sophisticated, zero-click iOS spyware named Coruna and DarkSword. This spyware, which targets vulnerable iOS versions, is designed to exfiltrate device information, keychain secrets, and credentials from major cryptocurrency wallets, including Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink, and Bitpie. The attack infrastructure heavily features Chinese-language elements, and mitigation requires website owners to audit third-party scripts and implement Content Security Policies, while end-users must keep iOS devices updated, utilize multi-factor authentication, and consider enabling iOS Lockdown Mode.

Severity: Critical

Threat Details and IOCs

Malware:	Coruna, CryptoWaters, DarkSword, P7 DarkSword
CVEs:	CVE-2025-14174, CVE-2025-31277, CVE-2025-43510, CVE-2025-43520, CVE-2025-43529, CVE-2026-20700
Technologies:	Apple iOS, Binance, Bitget, Bitpie Wallet, Coinbase Wallet, Exodus Wallet, OKX, PrestaShop, TronLink, Trust Wallet
Threat Actors:	UNC6353, UNC6691
Attacker Countries:	China
Attacker Domains:	ad-track[.]live, cdn[.]gotoiphone[.]com, chainmate[.]top, ecomtrack[.]io, mzpo30[.]cam, zhengxin021[.]top
Victim Industries:	Advertising Services, Financial Services, Gaming, Retail, Travel
Victim Countries:	Austria, Belgium, Bulgaria, China, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden

Mitigation Advice

Using your Mobile Device Management (MDM) solution, enforce an immediate update of all corporate-owned and BYOD iPhones to the latest available iOS version.
Add the known DeadTag and spyware-related domains (e.g., ad-track[.]live, cdn[.]gotoiphone[.]com, mzpo30[.]cam, ecomtrack[.]io) to your network firewall, DNS filter, and web proxy blocklists.
Instruct the web development team to immediately audit all public-facing company websites for abandoned third-party scripts and remove any code that links to expired or unused services.
Identify high-risk employees, such as executives and finance personnel, and instruct them to enable Lockdown Mode on their iPhones to significantly reduce the attack surface against zero-click exploits.
Send a security alert to all employees warning them about malvertising campaigns that cause unexpected browser redirects. Instruct them to immediately close the browser tab and report the incident if it occurs.

Compliance Best Practices

Develop and implement a strict Content Security Policy (CSP) for all company websites to whitelist approved sources for scripts, thereby preventing the execution of malicious code from unauthorized or compromised third-party domains.
Implement or configure a Mobile Device Management (MDM) solution to enforce security policies, such as requiring a device PIN, setting a minimum OS version, and automatically installing security updates on all enrolled mobile devices.
Deploy a network-level DNS filtering or secure web gateway solution to block categories like advertising, scams, and known malicious sites for all users on the corporate network.
Establish and enforce a corporate policy that requires multi-factor authentication (MFA) on all business-related financial, cloud, and cryptocurrency applications to prevent account takeover even if a device is compromised.
Establish a continuous security awareness training program that includes modules on mobile security, identifying malvertising, and reporting suspicious browser behavior and phishing attempts.

Sources

https://moonlock.com/corina-darksword-infecting-iphones

Active Exploitation Targets WordPress Core Unauthenticated Race Condition Leading to Remote Code Execution

Threat actors are actively attempting to exploit a newly patched, high-severity unauthenticated race condition in the WordPress Core update process that can lead to remote code execution. Patched on October 28, 2026, in WordPress version 7.1.4 and backported to legacy branches down to version 4.7, the vulnerability stems from predictable, web-accessible staging paths used during full-package upgrades. To successfully execute an attack, threat actors must target a narrow, seconds-long window while WordPress unpacks a complete Core update, specifically polling for staged `setup-config.php` installer paths. Security telemetry indicates rapid exploitation attempts, with over 18,500 requests targeting these paths within 21 hours of the patch release, though no successful compromises have been reported. The WordPress 7.1.4 update mitigates this flaw by randomizing the staging directory, adding an index guard, and preventing the unsafe promotion of staged configuration data, while also addressing 22 other security defects, including cross-site scripting (XSS) and authorization weaknesses.

Severity: Critical

Threat Details and IOCs

CVEs:	CVE-2026-119977
Technologies:	PHP, WordPress

Mitigation Advice

Immediately update all WordPress instances to version 7.1.4 or the latest patched version available for your specific branch.
Ensure your Web Application Firewall (WAF) has up-to-date rules to block requests targeting `setup-config.php` in WordPress staging directories like `wp-content/upgrade/`.
Scan web server access logs for requests targeting `setup-config.php` within the `wp-content/upgrade/` directory to identify attempted or successful exploitation.

Compliance Best Practices

Implement and configure an automated patch management system for all WordPress sites to ensure critical security updates are applied as soon as they are released.
Harden web server configurations to deny direct web access to sensitive WordPress directories, such as `wp-content/upgrade/` and `wp-content/uploads/`, unless explicitly required.
Deploy a File Integrity Monitoring (FIM) solution to alert on unexpected file creation or modification within the WordPress file system.
Establish a formal vulnerability management program that includes subscribing to security advisories for all critical software, including WordPress, to ensure timely awareness and risk assessment of new vulnerabilities.

Sources

https://gbhackers.com/wordpress-7-1-4-fixes-22-security-vulnerabilities/

https://securityonline.info/wordpress-7-1-4-security-release/

https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/

Apache Struts2 Core Arbitrary Code Execution via OGNL Sandbox Escape

Apache Struts2 Core versions 7.4.0 and below are vulnerable to arbitrary code execution via an Object-Graph Navigation Language (OGNL) sandbox escape. While the platform attempts to restrict OGNL execution using `SecurityMemberAccess`, these protections only guard against immediate calls evaluated by the OGNL engine. Attackers can bypass these restrictions by leveraging allowed calls that accept nested arguments and internally invoke reflection, executing outside the scope of the cursory protections. In versions 6.x and below, which rely primarily on blacklists, attackers can execute arbitrary code by embedding reflective calls within non-blacklisted classes such as `java.beans.Statement` and `java.beans.Expression`. In version 7.x, which utilizes a whitelist-based approach, exploitation requires an explicitly whitelisted wrapper class to execute the nested call. This vulnerability allows attackers to bypass class, method, static, and non-static checks to execute arbitrary system commands, as demonstrated by the payload: `GET /search.action?query=new java.beans.Expression(new java.beans.Expression(@java.lang.ProcessBuilder@class,'new',new Object[]{new String[]{'/bin/sh','-c','id > <<REPLACE ME -- a fresh marker file path>>'}}).getValue(),'start',new Object[0]).getValue()`.

Severity: Critical

Threat Details and IOCs

CVEs:	CVE-2026-104711
Attacker URLs:	/search.action?query=new+java.beans.Expression(new+java.beans.Expression(%40java.lang.ProcessBuilder%40class, 'new', new+Object%5B%5D%7Bnew+String%5B%5D%7B'/bin/sh', '-c', 'id+%3E+%3C%3CREPLACE+ME+--+a+fresh+marker+file+path%3E%3E'%7D%7D)[.]getValue(), 'start', new+Object%5B0%5D)[.]getValue()
Victim Industries:	Financial Services, Government, Healthcare, IT and DevOps, Manufacturing, Retail, Telecommunications, Utilities

Mitigation Advice

Identify all systems running Apache Struts2 and upgrade the Struts2 Core library to a version higher than 7.4.0 as soon as a patch is released.
For systems running Apache Struts2 version 6.x or below, add `java.beans.Statement` and `java.beans.Expression` to the `struts.excludedClasses` configuration setting to block the exploit.
For systems running Apache Struts2 version 7.x, audit the `struts.allowlist.classes` configuration and immediately remove any dangerous reflection-enabling classes, specifically ensuring `java.beans.Statement` and `java.beans.Expression` are not present.
Configure your Web Application Firewall (WAF) to create rules that detect and block HTTP requests containing the strings 'java.beans.Expression' or 'java.beans.Statement' within URL parameters or the request body.
Using your SIEM or log management platform, search historical web server access logs for requests containing the strings 'java.beans.Expression' or 'java.beans.Statement' to identify potential past or ongoing exploitation.

Compliance Best Practices

Implement and maintain a comprehensive software asset inventory, including a Software Bill of Materials (SBOM), for all applications to enable rapid identification of vulnerable components like Apache Struts2 in the future.
Review and reconfigure all web application service accounts to run with the minimum necessary permissions, ensuring they cannot execute system-level commands or access sensitive files and directories outside of the application's intended scope.
Deploy and tune an Endpoint Detection and Response (EDR) solution on all web servers to detect and alert on anomalous process creation, such as a Java application process spawning a command shell (e.g., sh, bash, cmd.exe, powershell.exe).
Establish a mandatory security training program for developers that specifically covers the risks of insecure framework configurations, such as the dangers of overly permissive whitelisting in Apache Struts2.
Isolate public-facing web servers in a dedicated network zone (DMZ) with strict firewall rules that restrict traffic to and from the internal corporate network, limiting the potential for lateral movement after a compromise.

Sources

https://seclists.org/fulldisclosure/2026/Nov/7

CVE-2026-111585: Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow

A high-severity integer overflow vulnerability, tracked as CVE-2026-111585 with a CVSS score of 8.8, exists in the remote-control screen decompression component of TeamViewer clients, including the Full Client, Portable, and Remote Control App prior to version 15.83. The security flaw occurs within the `CBitmapBuffer` constructor when processing attacker-controlled display parameters, such as a width and height of 0x8000 and a stride of 0x20040. This causes a 32-bit plane size calculation to wrap, allocating only 4 MB instead of the required 4.3 GB, which allows a subsequent XOR-RLE tile decoder operation with a crafted run record to execute an out-of-bounds write. This heap-based buffer overflow can result in a denial of service via process crash (SIGSEGV) or potential arbitrary code execution with the privileges of the viewer process. Successful exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host, affecting various legacy versions across Windows, Linux, and macOS, with remediation requiring an upgrade to version 15.83 or patched legacy releases.

Severity: Critical

Threat Details and IOCs

Malware:	GameOver Zeus, Serpent, SolanaCry, Zbot, Zeus, Zyklon, Zyklon HTTP, Zyklon Locker
CVEs:	CVE-2026-111582, CVE-2026-111583, CVE-2026-111584, CVE-2026-111585, CVE-2026-92372, CVE-2026-92374, CVE-2026-92375, CVE-2026-92376, CVE-2026-92377
Technologies:	Apple macOS, Google Android, Linux, Microsoft Windows, TeamViewer
Victim Industries:	Healthcare, Information Technology
Victim Countries:	France

Mitigation Advice

Use asset inventory, endpoint detection and response (EDR), or vulnerability scanning tools to identify all systems with TeamViewer Full Client, Portable, or Remote Control App installed.
Upgrade all identified TeamViewer installations to version 15.83 or newer. For legacy systems, upgrade to the specific patched versions listed in the advisory (e.g., 15.64.10 for Legacy Windows 7 & 8).
Issue an immediate security bulletin to all employees instructing them not to use TeamViewer to connect to any unknown or unsolicited remote hosts.
If immediate patching is not feasible, configure the corporate firewall to temporarily block outbound TCP/UDP traffic on port 5938 to prevent connections to external TeamViewer hosts.

Compliance Best Practices

Implement or improve a centralized software and patch management system to automate the deployment of security updates for all third-party applications across all endpoints.
Implement an application control or whitelisting policy using an EDR or similar tool to restrict the execution of unauthorized applications, including portable versions of remote access software.
Implement a default-deny egress filtering policy on the network firewall, explicitly allowing only outbound traffic required for legitimate business purposes.
Conduct a formal review of all remote access tools in use, standardize on a minimal set of approved solutions, and create a process to decommission unauthorized software.