Zero Radar
← feed
CriticalSecurity incidentupdated 30 Oct 2026, 15:21 UTC

PHP2Shell flaws actively exploited against internet-facing servers and firewalls

Attackers are abusing recently patched PHP bugs to take control of servers and firewalls that are reachable from the internet. Some of these attacks have reached government-affiliated systems.

Attacks reported (The Hacker News, Hacker News)5 independent sources
SeverityCriticalSecurity incident
Being exploited?ReportedBy The Hacker News, Hacker News, BleepingComputer, The Record, SecurityWeek, not officially confirmed yet
What to doCheck exposurePatch PHP2Shell on all servers and take Palo Alto management interfaces off the public internet right away.
How sure is this?5 independent sourcesSeveral independent publishers agree

How the attack works simplified

  1. 1Attacker scansFinds internet-exposed PHP and firewall interfaces
  2. 2Exploits PHP2ShellSends crafted requests to the vulnerable service
  3. 3Gains shell accessRuns commands on the server as a normal user
  4. 4Chains FragnesiaUses a Linux kernel bug to gain root
  5. ResultAttacker controls the server as root

What happened

Critical PHP vulnerabilities (PHP2Shell) are being exploited against publicly exposed management interfaces, including Palo Alto Networks firewalls, and are chained with a Linux kernel privilege escalation flaw (Fragnesia) to gain root access.

Why it is dangerous: Successful exploitation lets attackers run commands with full control of the affected system, with at least 25 servers reported rooted, including US government-affiliated servers. Over 22.6 million internet-exposed instances are potentially affected.

Are you affected?

You are affected if you run PHP versions with the recently patched PHP2Shell flaws, or expose Palo Alto Networks management interfaces or unpatched Linux kernels to the internet.

PHP installations with the PHP2Shell vulnerabilities (exact versions unknown); Palo Alto Networks management interfaces exposed to the internet (versions unknown); Linux kernels affected by the Fragnesia flaw (versions unknown).

What to do

  1. Apply the patched PHP2Shell updates to all PHP installations immediately
  2. Remove internet access to Palo Alto Networks management interfaces and apply the vendor's advisory fix
  3. Patch the Linux kernel to address the Fragnesia privilege escalation flaw
  4. Check systems for signs of compromise, such as unexpected commands or new accounts

Timeline

  1. 29 Oct 2026, 05:50 UTC
    Publicly disclosed
  2. 29 Oct 2026, 05:50 UTC
    Reported by The Hacker News · The Hacker News
  3. 29 Oct 2026, 06:54 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 13:35 UTC
    Hacker News reported on it · Hacker News
  5. 29 Oct 2026, 14:00 UTC
    BleepingComputer reported on it · BleepingComputer
  6. 29 Oct 2026, 20:11 UTC
    The Record reported on it · The Record
  7. 30 Oct 2026, 15:21 UTC
    SecurityWeek reported on it · SecurityWeek

Sources 5 reports, oldest first

Security press established security newsrooms

Community discussion sites, treat with care

Technical details

ID
ZR-f4eff089 · ZR-6c129a86 · ZR-5ec9d44a
Disclosed
29 Oct 2026, 05:50 UTC
On Zero Radar
29 Oct 2026, 06:54 UTC (1 h after disclosure)
Last change
30 Oct 2026, 15:21 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

PHP2Shell flaws actively exploited against internet-facing servers and firewalls · Zero Radar