F5 Labs Weekly Threat Bulletin, November 4, 2026; PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619; Fragnesia CVE-2026-46300
25 PAN-OS Systems Breached Through One Chain: PHP2Shell to Root, Then a Tunnel Into a Government-Affiliated Network
F5 Labs reports that attackers have compromised 25 Palo Alto Networks PAN-OS systems, 24 perimeter firewalls and one internal management server, by chaining the PHP2Shell remote code execution flaws with the Fragnesia Linux kernel privilege escalation flaw. The PHP2Shell pair, CVE-2026-109618 and CVE-2026-109619, rated 9.2 under CVSS 4.0, abuse PHP session-upload handling and heap allocations to bypass address space layout randomization and execute arbitrary code through the system() function. In this campaign the exploit was custom-built for the uniform PHP 8.0.30 build of the PAN-OS appweb management server. Fragnesia, CVE-2026-46300, then escalated the foothold to root. From there the operators established a persistent reverse SSH tunnel into a United States government-affiliated environment, which let them pivot internally and harvest directory-service credentials. F5 sets out the mitigations plainly: apply the vendor-supported PAN-OS remediations, update standalone PHP deployments to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or temporarily disable session.upload_progress.enabled to close the upload-progress attack path.
Executives
The firewall is supposed to be the wall. In this campaign it was the door, and the attackers walked from the perimeter device into a government-affiliated network and took directory credentials, the keys that unlock everything else. The board question is not whether PAN-OS is patched in general; it is whether the management interfaces of your firewalls are reachable from networks that do not need them, and whether a compromise of one edge device would be detected before it became a tunnel.
CIO / CISO
Work this as a compromise scenario, not a patching ticket, on any PAN-OS system that lagged on PHP2Shell. The chain ends in credential harvesting, so closure includes directory-service credential review and rotation where exposure is plausible, hunting for reverse SSH tunnels and unexpected outbound sessions from firewall management addresses, and confirming the management plane is restricted to a dedicated network. The interim PHP mitigation, disabling session.upload_progress.enabled, is a same-day lever where a full update needs a window.
Engineers
Apply the vendor PAN-OS remediation and verify the running build, not the scheduled job. On standalone PHP, move to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 for your branch. Then hunt the chain in order: session-upload exploitation traces on the management server, privilege escalation artifacts, new or modified SSH configuration, and tunnels initiated from the firewall itself. Edge devices rarely get endpoint tooling, so log review is the detection you have; make sure those logs leave the device.
Everyone (non-IT)
Nothing here asks anything of you directly. It is worth knowing that the equipment guarding a network can itself be attacked, which is why IT teams sometimes take firewalls offline for urgent updates at awkward hours. That interruption is the cheaper outcome.