🔍 PHP2 Shell root PAN-OS Firewallers chain PHP2 Shell bugs CVE-2026-109618 and CVE-2026-109619 with Fragnesia kernel flaw CVE-2026-46300 to gain root on PAN-OS devices. Hunt.io documented 24 internet-connected firewalls and one internal management server, with tools tailored to the Appweb management service and a uniform PHP 8.0.30 build in a targeted environment. The campaign also identified about 19,000 PAN-OS firewalls and 240 targets narrowed by geography and version. The key takeaway is reliability: this was not a wide spray-and-pray exploit across mixed PHP assets, but a deliberate intrusion chain against a consistent management stack. Post-compromise activity reported included an SSH reverse tunnel, showing firewall access served as a pivot, not an endpoint. 🛰️ Open Sources - Closed Narratives

🔍 PHP2 Shell root PAN-OS Firewallers chain PHP2 Shell bugs CVE-2026-109618 and CVE-2026-109619 with Fragnesia kernel flaw CVE-2026-46300 to gain root on PAN-OS devices. Hunt.io documented 24 internet-connected firewalls and one internal management server, with tools tailored to the Appweb management service and a uniform PHP 8.0.30 build in a targeted environment. The campaign also identified about 19,000 PAN-OS firewalls and 240 targets narrowed by geography and version. The key takeaway is reliability: this was not a wide spray-and-pray exploit across mixed PHP assets, but a deliberate intrusion chain against a consistent management stack. Post-compromise activity reported included an SSH reverse tunnel, showing firewall access served as a pivot, not an endpoint. 🛰️ Open Sources - Closed Narratives