Threat actors have compromised 25 Palo Alto Networks PAN-OS systems, including 24 perimeter firewalls and one internal management server, by chaining critical PHP2Shell remote code execution vulnerabilities with a Linux kernel privilege escalation flaw, F5 Labs reports in its weekly threat bulletin of 4 November 2026.

How the attack worked

The PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS 4.0 rating of 9.2, exploit PHP's session-upload handling and heap allocations to bypass address space layout randomisation and execute code through the system function, F5 reports. The attackers used a custom exploit tailored to the uniform PHP 8.0.30 build of the PAN-OS appweb management server, then used the Fragnesia Linux kernel flaw, CVE-2026-46300, to escalate privileges to root. Once inside, the operators established a persistent reverse SSH tunnel into a United States government-affiliated environment, allowing them to move internally and harvest directory-service credentials. F5 does not name the threat actor responsible in the bulletin extract, and no attribution is claimed here.

Separate official warning

Singapore's Cyber Security Agency issued its own alert on 3 November, reported by CVETodo, saying Palo Alto Networks had reported active exploitation of PHP2Shell against internet-exposed firewall management interfaces, with attackers also chaining it to the Linux kernel flaw to gain root. That alert is consistent with the F5 account of the campaign, but the two reports describe the exploitation pattern rather than a single confirmed victim list, and the 25-system figure comes from F5's bulletin.

What defenders should do

F5 says organisations must apply vendor-supported PAN-OS remediations, update standalone PHP deployments to versions 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or temporarily disable session.upload_progress.enabled to block the upload-progress attack path. Internet-exposed firewall management interfaces should be treated as the highest priority, given the reported active exploitation. This report is separate from the WordPress flaw added to CISA's exploited list this week, which affects a different product and vulnerability.

Sources: F5 Labs, Weekly Threat Bulletin, 4 November 2026; CVETodo, Daily Cyber Threat Report (Singapore), 3 November 2026, reporting the CSA alert on PHP2Shell exploitation.