PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Hi, what are you looking for?

Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.

By

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Threat actors have been hammering servers vulnerable toPHP2Shellfor over a week, but only a few successful compromises have been confirmed to date.Standing out are Palo Alto Networks firewalls, which have beenrooted by a China-linked hacking groupin attacks chaining PHP2Shell with the Fragnesia kernel privilege escalation bug.Assisted by AI, the hackers chained two separate exploits: one specifically targeting the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 on Palo Alto Networks’ PAN-OS devices, and another one for Fragnesia to deploy webshells with root privileges.Cybersecurity outfit Dream flagged the campaign earlier this week, noting that at least 25 firewalls out of a pool of hundreds were hacked. Palo Alto Networks has since confirmed the findings.“Dream Research has reported a campaign in which attackers chained PHP2Shell with a Linux kernel privilege-escalation vulnerability to gain root access. Unit 42 has independently verified the same attacker’s tooling and confirmed the reported results,” Palo Alto Networkssaid.The company has rolled out patches that resolve the PHP2Shell flaws in PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 for PA-Series and VM-Series firewalls, and for Panorama (virtual and M-Series).Advertisement. Scroll to continue reading.“No special configuration is required to be affected by this issue. Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet,” the company notes in itsadvisory.Palo Alto Networks says that by default the management interface is not exposed to the internet and urges customers to immediately restrict access to it and apply the available fixes.“Only a small fraction of a percent (approximately .02%) of our global installed base has internet-facing management interfaces configured and was impacted. Each of these customers has been individually contacted by our teams. We will continue to investigate and provide any necessary updates as they become available,” Palo Alto Networks notes.22.6 million exposed PHP instancesAccording to the company, as of October 29, its telemetry has identified over 22.6 million exposed PHP instances that are potentially vulnerable to the PHP2Shell bugs.That is not surprising, given that PHP is widely used across servers and content management systems, including WordPress, Drupal, Joomla, and many others.The mass PHP2Shell exploitation has been targeting those as well, but remained largely unsuccessful, at least when it comes to WordPress, web security firmDefiant says.As of October 28, it was not aware of any WordPress site being compromised via PHP2Shell exploitation, although it has recorded over 77,000 related requests from more than 2,000 IP addresses.However, Defiant points out that testing has revealed the exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP build, running extensions, memory limits, and the server’s request handling.“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.A handful of IPsDespite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

Standing out are Palo Alto Networks firewalls, which have beenrooted by a China-linked hacking groupin attacks chaining PHP2Shell with the Fragnesia kernel privilege escalation bug.Assisted by AI, the hackers chained two separate exploits: one specifically targeting the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 on Palo Alto Networks’ PAN-OS devices, and another one for Fragnesia to deploy webshells with root privileges.Cybersecurity outfit Dream flagged the campaign earlier this week, noting that at least 25 firewalls out of a pool of hundreds were hacked. Palo Alto Networks has since confirmed the findings.“Dream Research has reported a campaign in which attackers chained PHP2Shell with a Linux kernel privilege-escalation vulnerability to gain root access. Unit 42 has independently verified the same attacker’s tooling and confirmed the reported results,” Palo Alto Networkssaid.The company has rolled out patches that resolve the PHP2Shell flaws in PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 for PA-Series and VM-Series firewalls, and for Panorama (virtual and M-Series).Advertisement. Scroll to continue reading.“No special configuration is required to be affected by this issue. Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet,” the company notes in itsadvisory.Palo Alto Networks says that by default the management interface is not exposed to the internet and urges customers to immediately restrict access to it and apply the available fixes.“Only a small fraction of a percent (approximately .02%) of our global installed base has internet-facing management interfaces configured and was impacted. Each of these customers has been individually contacted by our teams. We will continue to investigate and provide any necessary updates as they become available,” Palo Alto Networks notes.22.6 million exposed PHP instancesAccording to the company, as of October 29, its telemetry has identified over 22.6 million exposed PHP instances that are potentially vulnerable to the PHP2Shell bugs.That is not surprising, given that PHP is widely used across servers and content management systems, including WordPress, Drupal, Joomla, and many others.The mass PHP2Shell exploitation has been targeting those as well, but remained largely unsuccessful, at least when it comes to WordPress, web security firmDefiant says.As of October 28, it was not aware of any WordPress site being compromised via PHP2Shell exploitation, although it has recorded over 77,000 related requests from more than 2,000 IP addresses.However, Defiant points out that testing has revealed the exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP build, running extensions, memory limits, and the server’s request handling.“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.A handful of IPsDespite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

Assisted by AI, the hackers chained two separate exploits: one specifically targeting the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 on Palo Alto Networks’ PAN-OS devices, and another one for Fragnesia to deploy webshells with root privileges.Cybersecurity outfit Dream flagged the campaign earlier this week, noting that at least 25 firewalls out of a pool of hundreds were hacked. Palo Alto Networks has since confirmed the findings.“Dream Research has reported a campaign in which attackers chained PHP2Shell with a Linux kernel privilege-escalation vulnerability to gain root access. Unit 42 has independently verified the same attacker’s tooling and confirmed the reported results,” Palo Alto Networkssaid.The company has rolled out patches that resolve the PHP2Shell flaws in PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 for PA-Series and VM-Series firewalls, and for Panorama (virtual and M-Series).Advertisement. Scroll to continue reading.“No special configuration is required to be affected by this issue. Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet,” the company notes in itsadvisory.Palo Alto Networks says that by default the management interface is not exposed to the internet and urges customers to immediately restrict access to it and apply the available fixes.“Only a small fraction of a percent (approximately .02%) of our global installed base has internet-facing management interfaces configured and was impacted. Each of these customers has been individually contacted by our teams. We will continue to investigate and provide any necessary updates as they become available,” Palo Alto Networks notes.22.6 million exposed PHP instancesAccording to the company, as of October 29, its telemetry has identified over 22.6 million exposed PHP instances that are potentially vulnerable to the PHP2Shell bugs.That is not surprising, given that PHP is widely used across servers and content management systems, including WordPress, Drupal, Joomla, and many others.The mass PHP2Shell exploitation has been targeting those as well, but remained largely unsuccessful, at least when it comes to WordPress, web security firmDefiant says.As of October 28, it was not aware of any WordPress site being compromised via PHP2Shell exploitation, although it has recorded over 77,000 related requests from more than 2,000 IP addresses.However, Defiant points out that testing has revealed the exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP build, running extensions, memory limits, and the server’s request handling.“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.A handful of IPsDespite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

Cybersecurity outfit Dream flagged the campaign earlier this week, noting that at least 25 firewalls out of a pool of hundreds were hacked. Palo Alto Networks has since confirmed the findings.“Dream Research has reported a campaign in which attackers chained PHP2Shell with a Linux kernel privilege-escalation vulnerability to gain root access. Unit 42 has independently verified the same attacker’s tooling and confirmed the reported results,” Palo Alto Networkssaid.The company has rolled out patches that resolve the PHP2Shell flaws in PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 for PA-Series and VM-Series firewalls, and for Panorama (virtual and M-Series).Advertisement. Scroll to continue reading.“No special configuration is required to be affected by this issue. Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet,” the company notes in itsadvisory.Palo Alto Networks says that by default the management interface is not exposed to the internet and urges customers to immediately restrict access to it and apply the available fixes.“Only a small fraction of a percent (approximately .02%) of our global installed base has internet-facing management interfaces configured and was impacted. Each of these customers has been individually contacted by our teams. We will continue to investigate and provide any necessary updates as they become available,” Palo Alto Networks notes.22.6 million exposed PHP instancesAccording to the company, as of October 29, its telemetry has identified over 22.6 million exposed PHP instances that are potentially vulnerable to the PHP2Shell bugs.That is not surprising, given that PHP is widely used across servers and content management systems, including WordPress, Drupal, Joomla, and many others.The mass PHP2Shell exploitation has been targeting those as well, but remained largely unsuccessful, at least when it comes to WordPress, web security firmDefiant says.As of October 28, it was not aware of any WordPress site being compromised via PHP2Shell exploitation, although it has recorded over 77,000 related requests from more than 2,000 IP addresses.However, Defiant points out that testing has revealed the exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP build, running extensions, memory limits, and the server’s request handling.“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.A handful of IPsDespite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

“Dream Research has reported a campaign in which attackers chained PHP2Shell with a Linux kernel privilege-escalation vulnerability to gain root access. Unit 42 has independently verified the same attacker’s tooling and confirmed the reported results,” Palo Alto Networkssaid.The company has rolled out patches that resolve the PHP2Shell flaws in PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 for PA-Series and VM-Series firewalls, and for Panorama (virtual and M-Series).Advertisement. Scroll to continue reading.“No special configuration is required to be affected by this issue. Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet,” the company notes in itsadvisory.Palo Alto Networks says that by default the management interface is not exposed to the internet and urges customers to immediately restrict access to it and apply the available fixes.“Only a small fraction of a percent (approximately .02%) of our global installed base has internet-facing management interfaces configured and was impacted. Each of these customers has been individually contacted by our teams. We will continue to investigate and provide any necessary updates as they become available,” Palo Alto Networks notes.22.6 million exposed PHP instancesAccording to the company, as of October 29, its telemetry has identified over 22.6 million exposed PHP instances that are potentially vulnerable to the PHP2Shell bugs.That is not surprising, given that PHP is widely used across servers and content management systems, including WordPress, Drupal, Joomla, and many others.The mass PHP2Shell exploitation has been targeting those as well, but remained largely unsuccessful, at least when it comes to WordPress, web security firmDefiant says.As of October 28, it was not aware of any WordPress site being compromised via PHP2Shell exploitation, although it has recorded over 77,000 related requests from more than 2,000 IP addresses.However, Defiant points out that testing has revealed the exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP build, running extensions, memory limits, and the server’s request handling.“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.A handful of IPsDespite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

The company has rolled out patches that resolve the PHP2Shell flaws in PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 for PA-Series and VM-Series firewalls, and for Panorama (virtual and M-Series).Advertisement. Scroll to continue reading.“No special configuration is required to be affected by this issue. Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet,” the company notes in itsadvisory.Palo Alto Networks says that by default the management interface is not exposed to the internet and urges customers to immediately restrict access to it and apply the available fixes.“Only a small fraction of a percent (approximately .02%) of our global installed base has internet-facing management interfaces configured and was impacted. Each of these customers has been individually contacted by our teams. We will continue to investigate and provide any necessary updates as they become available,” Palo Alto Networks notes.22.6 million exposed PHP instancesAccording to the company, as of October 29, its telemetry has identified over 22.6 million exposed PHP instances that are potentially vulnerable to the PHP2Shell bugs.That is not surprising, given that PHP is widely used across servers and content management systems, including WordPress, Drupal, Joomla, and many others.The mass PHP2Shell exploitation has been targeting those as well, but remained largely unsuccessful, at least when it comes to WordPress, web security firmDefiant says.As of October 28, it was not aware of any WordPress site being compromised via PHP2Shell exploitation, although it has recorded over 77,000 related requests from more than 2,000 IP addresses.However, Defiant points out that testing has revealed the exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP build, running extensions, memory limits, and the server’s request handling.“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.A handful of IPsDespite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

“No special configuration is required to be affected by this issue. Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet,” the company notes in itsadvisory.Palo Alto Networks says that by default the management interface is not exposed to the internet and urges customers to immediately restrict access to it and apply the available fixes.“Only a small fraction of a percent (approximately .02%) of our global installed base has internet-facing management interfaces configured and was impacted. Each of these customers has been individually contacted by our teams. We will continue to investigate and provide any necessary updates as they become available,” Palo Alto Networks notes.22.6 million exposed PHP instancesAccording to the company, as of October 29, its telemetry has identified over 22.6 million exposed PHP instances that are potentially vulnerable to the PHP2Shell bugs.That is not surprising, given that PHP is widely used across servers and content management systems, including WordPress, Drupal, Joomla, and many others.The mass PHP2Shell exploitation has been targeting those as well, but remained largely unsuccessful, at least when it comes to WordPress, web security firmDefiant says.As of October 28, it was not aware of any WordPress site being compromised via PHP2Shell exploitation, although it has recorded over 77,000 related requests from more than 2,000 IP addresses.However, Defiant points out that testing has revealed the exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP build, running extensions, memory limits, and the server’s request handling.“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.A handful of IPsDespite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

Palo Alto Networks says that by default the management interface is not exposed to the internet and urges customers to immediately restrict access to it and apply the available fixes.“Only a small fraction of a percent (approximately .02%) of our global installed base has internet-facing management interfaces configured and was impacted. Each of these customers has been individually contacted by our teams. We will continue to investigate and provide any necessary updates as they become available,” Palo Alto Networks notes.22.6 million exposed PHP instancesAccording to the company, as of October 29, its telemetry has identified over 22.6 million exposed PHP instances that are potentially vulnerable to the PHP2Shell bugs.That is not surprising, given that PHP is widely used across servers and content management systems, including WordPress, Drupal, Joomla, and many others.The mass PHP2Shell exploitation has been targeting those as well, but remained largely unsuccessful, at least when it comes to WordPress, web security firmDefiant says.As of October 28, it was not aware of any WordPress site being compromised via PHP2Shell exploitation, although it has recorded over 77,000 related requests from more than 2,000 IP addresses.However, Defiant points out that testing has revealed the exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP build, running extensions, memory limits, and the server’s request handling.“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.A handful of IPsDespite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

“Only a small fraction of a percent (approximately .02%) of our global installed base has internet-facing management interfaces configured and was impacted. Each of these customers has been individually contacted by our teams. We will continue to investigate and provide any necessary updates as they become available,” Palo Alto Networks notes.22.6 million exposed PHP instancesAccording to the company, as of October 29, its telemetry has identified over 22.6 million exposed PHP instances that are potentially vulnerable to the PHP2Shell bugs.That is not surprising, given that PHP is widely used across servers and content management systems, including WordPress, Drupal, Joomla, and many others.The mass PHP2Shell exploitation has been targeting those as well, but remained largely unsuccessful, at least when it comes to WordPress, web security firmDefiant says.As of October 28, it was not aware of any WordPress site being compromised via PHP2Shell exploitation, although it has recorded over 77,000 related requests from more than 2,000 IP addresses.However, Defiant points out that testing has revealed the exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP build, running extensions, memory limits, and the server’s request handling.“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.A handful of IPsDespite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

According to the company, as of October 29, its telemetry has identified over 22.6 million exposed PHP instances that are potentially vulnerable to the PHP2Shell bugs.That is not surprising, given that PHP is widely used across servers and content management systems, including WordPress, Drupal, Joomla, and many others.The mass PHP2Shell exploitation has been targeting those as well, but remained largely unsuccessful, at least when it comes to WordPress, web security firmDefiant says.As of October 28, it was not aware of any WordPress site being compromised via PHP2Shell exploitation, although it has recorded over 77,000 related requests from more than 2,000 IP addresses.However, Defiant points out that testing has revealed the exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP build, running extensions, memory limits, and the server’s request handling.“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.A handful of IPsDespite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

That is not surprising, given that PHP is widely used across servers and content management systems, including WordPress, Drupal, Joomla, and many others.The mass PHP2Shell exploitation has been targeting those as well, but remained largely unsuccessful, at least when it comes to WordPress, web security firmDefiant says.As of October 28, it was not aware of any WordPress site being compromised via PHP2Shell exploitation, although it has recorded over 77,000 related requests from more than 2,000 IP addresses.However, Defiant points out that testing has revealed the exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP build, running extensions, memory limits, and the server’s request handling.“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.A handful of IPsDespite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

The mass PHP2Shell exploitation has been targeting those as well, but remained largely unsuccessful, at least when it comes to WordPress, web security firmDefiant says.As of October 28, it was not aware of any WordPress site being compromised via PHP2Shell exploitation, although it has recorded over 77,000 related requests from more than 2,000 IP addresses.However, Defiant points out that testing has revealed the exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP build, running extensions, memory limits, and the server’s request handling.“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.A handful of IPsDespite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

As of October 28, it was not aware of any WordPress site being compromised via PHP2Shell exploitation, although it has recorded over 77,000 related requests from more than 2,000 IP addresses.However, Defiant points out that testing has revealed the exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP build, running extensions, memory limits, and the server’s request handling.“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.A handful of IPsDespite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

However, Defiant points out that testing has revealed the exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP build, running extensions, memory limits, and the server’s request handling.“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.A handful of IPsDespite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.A handful of IPsDespite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

Despite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

According toCato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

Related:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

Related:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

Ionut Arghire is an international correspondent for SecurityWeek.

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

General Paul M. Nakasone has joined Armadin’s Board of Directors.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Got a confidential news tip? We want to hear from you.

Reach a large audience of enterprise cybersecurity professionals

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.