PHP2Shell attacks root Palo Alto firewalls but WordPress sites hold so far

A China-linked group chained the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 with the Fragnesia kernel privilege-escalation bug to install webshells with root privileges on Palo Alto PAN-OS firewalls, compromising at least 25 devices. Palo Alto has patched all affected PAN-OS branches plus Panorama and urges customers to keep the management interface off the internet. Attacks on WordPress sites have failed so far, but Defiant stresses that updating PHP remains essential.