← Saturday 31 Octobernote 9 of 15
CybersecuritySat 31 Oct 2026 · 9 of 15

China-linked hackers root Palo Alto firewalls using PHP2Shell and kernel bug

Verified · 6/6 supported1 cited · 1 min read

securityweek.com reports that over 22.6 million exposed instances may be affected by the critical PHP2Shell flaws CVE‑2026‑109618 and CVE‑2026‑109619 . securityweek.com reports that a China‑linked hacking group has rooted Palo Alto Networks firewalls by chaining PHP2Shell exploits with the Fragnesia Linux kernel privilege‑escalation vulnerability . securityweek.com reports that at least 25 firewalls out of a pool of hundreds were compromised in the campaign . securityweek.com reports that Palo Alto Networks confirmed the findings and has rolled out patches that fix the PHP2Shell flaws in PAN‑OS 12.2, 12.1, 11.2, 11.1 and 10.2 for PA‑Series, VM‑Series firewalls and Panorama . securityweek.com reports that Dream Research flagged the campaign earlier in the week and Unit 42 independently verified the attacker’s tooling .

Why it matters. securityweek.com reports that the release of patches for the affected PAN‑OS versions provides a means for organizations to remediate the PHP2Shell‑Fragnesia attack chain .

Earlier on Cybersecurity

Fri 30 Oct 2026US Voting System Faces Ongoing Cybersecurity Concernssecurityweek.com reports that the integrity of the US voting system is a continuing concern involving machine tampering, ballot counting, and voter influence, all with cybersecurity relevance. securityweek.com reports that the US voting process is a state‑run multi‑stage operation that varies by state and county. securityweek.com reports that while most voters use paper ballots, jurisdictions that use ballot‑marking devices for in‑person voting have the most cybersecurity relevance. securityweek.com reports that Election Day in‑person voting uses voting machines that are pre‑certified by the Election Assistance Commission and are air‑gapped for additional security. securityweek.com reports that these voting machines print a paper ballot with the voter’s choices, including a human‑readable element.Thu 29 Oct 2026Chrome 156 and Firefox 159 updates patch over 200 security flawssecurityweek.com reports that Google released Chrome version 156.0.8078.73/.74 for Windows and macOS and 156.0.8078.73 for Linux, patching 52 security bugs including four critical flaws. securityweek.com reports that Chrome 156 also patches 46 high‑severity bugs, mainly memory corruption, improper input validation, and use‑after‑free issues. securityweek.com reports that no bug bounty rewards will be paid for 39 of the Chrome vulnerabilities, most of which were found internally or with the aid of AI. securityweek.com reports that Mozilla released Firefox 159, which patches 167 security defects, including 108 high‑severity flaws, primarily fixing use‑after‑free issues and also addressing sandbox escape, privilege escalation, boundary and same‑origin policy bypass problems. securityweek.com reports that together the Chrome and Firefox updates address more than 200 vulnerabilities.Wed 28 Oct 2026Data breach at Denver Health Medical Plan exposes 238,000 members' informationsecurityweek.com reports that Denver Health Medical Plan (DHMP) notified roughly 238,000 members that their personal and health information may have been compromised. securityweek.com reports that the breach involved third‑party vendor SquareML, which provides a no‑code platform for healthcare analytics. securityweek.com reports that SquareML’s access key was inadvertently leaked on a publicly accessible website on June 27, 2025, and the vendor informed DHMP of the leak on August 14, 2026, with the key revoked on August 18, 2026. securityweek.com reports that the compromised account was read‑only, meaning the key could not be used to download, export, delete, or change any information. securityweek.com reports that potentially compromised data includes members’ names and health information, and that DHMP is a non‑profit managed‑care organization within the Denver Health and Hospital Authority system, administering Medicaid benefits in Denver and three surrounding counties.
Next · Climate techMeta partners with Fortera on low‑carbon cement plant in Missouri →