November 1, 2026 weekly
PHP2Shell Reached Root as Models Closed the Patch Gap
PHP2Shell reached production with Fragnesia kernel exploitation, rooting 25 servers across the US, Japan, Taiwan and South Korea including a US government Active Directory environment. GLM 5.3 autonomously built complete Firefox exploit chains from patch information without human input, while poisoned Claude Code extensions in Cursor marketplace and GitLab CVE-2026-97229 exploits demonstrated how developer tooling became privileged attack infrastructure. Management-plane attacks deepened across Cisco Catalyst SD-WAN, Tailscale SSH, and Azure API Connections, while ad networks from Discover-Tech supplied spyware delivery across Finnish critical infrastructure.