October 31, 2026
- PHP2Shell has its first confirmed production compromises — on PAN-OS. Hunt.io's week-later review finds shells elsewhere only on honeypots and sensors (watchTowr, 0x4D31, GreyNoise), but internet-facing Palo Alto firewalls rooted via an adaptation of the chain, with a PAN-OS-specific PoC served from
130.94.67[.]235. Dream Research reported operators chaining PHP2Shell with the Fragnesia kernel LPE (CVE-2026-46300) to root 25 servers, results Unit 42 says it verified; 616 related files surfaced in open directories, one operator shipping its own heap exploit and a log cleaner (Hunt.io). A Common Crawl sweep puts 6.87M of 18.58M PHP hosts (37%) disclosing potentially vulnerable versions (SwordSec); earlier coverage. · Vulnerabilities & Exploits
in Open-Weight Model Turns Firefox's Patch Gap Into Working Exploits