Attackers chain PHP and Linux flaws to take root control of Palo Alto firewalls

Singapore's Cyber Security Agency issued an alert on 3 November 2026 warning that attackers are actively exploiting PHP vulnerabilities dubbed PHP2Shell, CVE-2026-109618 and CVE-2026-109619. The flaws are being used against internet-exposed management interfaces of Palo Alto Networks firewalls running affected PAN-OS versions. Because the exploitation requires no authentication, a remote attacker can execute arbitrary code and gain initial access without credentials. Reports say attackers combined this with a Linux kernel privilege-escalation flaw, CVE-2026-46300, to obtain root privileges and move deeper into networks. The alert notes that other vendors' products are also affected and that the list of impacted products is not exhaustive.