PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

A China-linked threat actor has exploited the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, chaining them with the Fragnesia Linux kernel privilege-escalation flaw, to gain root access on Palo Alto Networks PAN-OS firewalls. Dream Research first spotted the campaign, finding around 25 compromised devices out of several hundred scanned, and Palo Alto Networks (via Unit 42) confirmed the activity, saying only internet-exposed management interfaces were hit—about 0.02% of its customer base. Fixes are now available for PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 on PA-Series and VM-Series devices as well as Panorama, and the vendor urges customers to restrict management-interface exposure immediately. Despite roughly 22.6 million internet-facing PHP instances flagged as potentially vulnerable, security researchers at Defiant, Cato Networks and WatchTowr report that mass exploitation attempts against platforms like WordPress have largely failed, with success limited to a small number of attackers and opportunistic, non-targeted scanning.