What Happened
Palo Alto Networks reports active exploitation of CVE-2026-109618 and CVE-2026-109619 against PAN-OS management interfaces exposed to the internet, according to The Hacker News. Both PHP flaws score CVSS 9.2 and allow unauthenticated remote code execution. PHP patched them upstream on October 21. The risk is highest when the management web interface and XML API face external IP addresses.
Israeli firm Dream separately reports a suspected China-nexus actor chaining PHP2Shell with Fragnesia, a Linux kernel privilege escalation bug rated CVSS 7.8. The campaign rooted 25 servers in the US, Japan, Taiwan, and South Korea, then targeted Active Directory. Dream did not name the firewall vendor. CISA added Fragnesia to its KEV catalog on October 28.
Why This Matters for Canadian Organizations
Palo Alto firewalls guard many Canadian enterprises, utilities, and public bodies. A management interface open to the internet hands an attacker root on the device guarding the network. From there, stolen directory credentials expose personal information covered by PIPEDA.
The pattern matters beyond one vendor. We covered the original PHP2Shell flaws earlier this month. Attackers now apply them to security appliances, which run PHP in their management layers and often wait longest for patches.
What to Do
Restrict management interface access to trusted internal IP addresses. Palo Alto calls this its recommended best practice. Apply fixed PAN-OS builds, such as 12.2.4-h1, 11.2.16-h1, 11.1.16-h4, and 10.2.18-h13. Some branches list fixes due October 29 and 30. Where fixes are not yet available, route management traffic through a dataplane port, enable Threat Prevention on inbound management traffic, and replace the management certificate. Patch Linux hosts for Fragnesia before the October 31 CISA deadline. Review recent logins and Active Directory activity on any exposed device. More in our Trends section.
