A week ago the story was fixes arriving ahead of attackers. That window has now closed for two vendors. Attackers have used PHP2Shell to take root control of internet-exposed Palo Alto Networks firewalls, and Cisco has confirmed that a new remote access VPN flaw is being used to crash ASA and FTD devices. Fixes for both are already available, so the job now is to apply them and lock down what faces the internet.
Select any diagram to view it at full size.
Where things stand on 5 November
Where things stand on 5 November | |
|---|---|
What | A run of urgent firewall security releases, PHP2Shell (CVE-2026-109618, CVE-2026-109619) in firewall web interfaces, and an exploited Cisco VPN flaw (CVE-2026-76418) |
Severity | High to Critical. PHP rates PHP2Shell 9.2 (CVSS v4.0); Cisco rates CVE-2026-76418 8.6 |
Exploited | Yes, against Palo Alto PAN-OS management interfaces (PHP2Shell) and Cisco ASA/FTD SSL VPN (denial of service). Nothing reported yet for Fortinet, Check Point or Juniper |
Fixes | Available from all five vendors. Every PAN-OS hotfix was out by 29 October |
Most at risk | Management interfaces, VPN and user portals reachable from the internet |
Do now | Check versions, upgrade as an emergency change, remove internet access to management, and hunt for signs of compromise on anything that was exposed |
Why the patches came first this time
Usually a firewall flaw is found, exploited and then fixed. This autumn the order flipped: vendors shipped urgent fixes for issues nobody had yet been seen abusing. Three forces drove that.
Machines are finding bugs faster than people. Fortinet credits frontier-AI testing for the critical and high-severity flaws fixed in its 22 October release. Cisco's 21 October Snort 3 hardening release grew out of internal testing that also used frontier AI models, and Cisco now bundles such findings into hardening releases on a fixed twice-monthly schedule.
Exploits now follow patches in hours, not weeks. The same AI tooling lets attackers diff a patched build against an unpatched one and work back to the flaw. That is why Fortinet held its CVE details back until 10 November.
Secrets are leaking before disclosure day. Details of PHP2Shell, a pair of critical flaws in the PHP engine, escaped on 20 October ahead of coordinated disclosure. PHP released its fix a day early, and vendors that embed PHP in their management or portal interfaces followed within days.
What has changed since our last update
PHP2Shell has rooted real firewalls. Dream Research uncovered a campaign that chained PHP2Shell with Fragnesia (CVE-2026-46300), a Linux kernel privilege-escalation flaw, to gain root on 25 exposed PAN-OS devices across the US, Japan, Taiwan and South Korea. The attacker then went after Active Directory, pulling credentials and mapping the directory. Unit 42 verified the tooling, tracks the actor as CL-UNK-1280, and says about 0.02% of Palo Alto's installed base was hit; each affected customer has been contacted (Help Net Security, Dream).
The exploit was custom and quick. It was built specifically for PAN-OS, with memory profiles for nine software versions, and went from an unauthenticated connection to a root webshell in under 15 minutes. Researchers also found AI tooling on the attacker's systems and a reconnaissance list of about 19,000 internet-facing Palo Alto firewalls (The Register, The Hacker News).
PAN-OS attack chain · 5 steps
Fragnesia is on CISA's exploited list. CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalogue on 28 October and noted it can be chained with PHP2Shell to run commands as root.
Cisco has a new exploited VPN flaw. CVE-2026-76418 lets an unauthenticated attacker reload an ASA or FTD firewall by sending a crafted request to the SSL remote access VPN login, but only where secondary authentication is configured on a tunnel group. Cisco published the fix on 28 October and CISA listed it as exploited the next day. The impact is an outage, not a takeover (Rescana).
Patching protects you. Palo Alto says customers who applied the hotfixes, or who keep management off the internet, are not affected by the observed campaign. Most PHP2Shell attempts elsewhere, for example against WordPress sites, are still failing (SecurityWeek). Expect a lot of noise in logs, but a single working exploit is enough.
Seven steps for every organisation
Whatever brand of firewall you run, start here. The vendor sections below give the exact fixed releases.
- Get management off the internet today. Allow the web UI, API and SSH only from a jump host or a dedicated management network. Check data-plane interfaces too: a management profile attached to an outside interface exposes the same service.
- Know exactly what you run. Read the version from each device itself, not from a change ticket. Include HA peers, standby and DR units, and management platforms such as Panorama, Firewall Management Center, FortiManager and Check Point management servers.
- Treat the upgrade as an emergency change. Do not wait for the next maintenance window. Where the vendor requires it, upgrade the management platform before the firewalls it controls.
- Hunt before you patch anything that was exposed. Look for administrator logins from unfamiliar addresses, new accounts, unexpected configuration changes, unexplained reloads or crashes, and outbound connections from the firewall to unknown hosts. For PAN-OS, also look for webshells and unexpected root activity. If anything turns up, call your security operations or incident response team first so evidence is preserved. A patch closes the hole; it does not remove an attacker who is already in.
- Bridge gaps with interim protection. Use vendor automatic mitigations, IPS or threat signatures, and switch off portals and services you do not need.
- Read your logs with care. PHP2Shell scanning is loud and most attempts fail. A flood of hits does not prove a device is at risk, and a quiet log does not prove it is safe.
- Get confirmation from whoever manages your firewalls, whether an in-house team or a provider, of which fixes are applied and when the rest are booked. And never run public exploit code against your own devices.
Find the guidance for your firewall
Vendors are listed by urgency, starting with those under active attack. Select your vendor for affected products, fixed releases and practical next steps.
01Palo Alto NetworksManagement exposure and PAN-OS hotfixesActive exploitation
Palo Alto Networks: exploited, all fixes released
Status | Actively exploited. Patch and investigate now |
|---|---|
Issue | PHP2Shell (CVE-2026-109618, CVE-2026-109619) in the management web interface (HTTPS web UI and XML API), chained in the wild with Fragnesia (CVE-2026-46300) |
Affected | PAN-OS 10.2 to 12.2 on PA-Series and VM-Series, and Panorama. No special configuration needed |
Not affected | GlobalProtect, Clientless VPN, Captive Portal, Cloud NGFW and Prisma Access |
Fixes | All 20 hotfixes released by 29 October |
The attack works against the management interface and any data-plane interface carrying a management profile. Palo Alto scores its exposure High (CVSS-B 8.7), dropping to 7.1 when only a jump host can reach management. The same hotfixes also close the Node.js Brotli flaw from our Node2Shell bulletin, except 11.2.10-h16, which fixes PHP2Shell only; 11.2.10-h17 carries both.
What to do
- Remove internet access to management immediately and allow the web UI and XML API only from trusted internal addresses or a jump host.
- If management was ever reachable from the internet since 20 October, investigate before upgrading: check admin logins, configuration changes, webshells and new local accounts, and contact your incident response team if anything looks wrong.
- Upgrade firewalls and Panorama to the hotfix for your train or a later release on the same major version. Panorama must run the same or a later version than the firewalls it manages.
- Threat Prevention customers: enable Threat ID 543004 and the related IDs in the advisory (content 9162 or later). These only cover management traffic that passes through an inspected data-plane interface, so they do not replace access restrictions.
PAN-OS fixed releases
If you run | Upgrade to at least |
|---|---|
12.2.0 to 12.2.4-h* | 12.2.4-h1 |
12.1.8 to 12.1.10-h* | 12.1.10-h3 |
12.1.5 to 12.1.7-h* | 12.1.7-h11 |
12.1.2 to 12.1.4-h* | 12.1.4-h13 |
11.2.14 to 11.2.16-h* | 11.2.16-h1 |
11.2.11 to 11.2.13-h* | 11.2.13-h4 |
11.2.8 to 11.2.10-h* | 11.2.10-h17 (h16 fixes PHP2Shell only) |
11.2.5 to 11.2.7-h* | 11.2.7-h23 |
11.2.0 to 11.2.4-h* | 11.2.4-h23 |
11.1.14 to 11.1.16-h* | 11.1.16-h4 |
11.1.11 to 11.1.13-h* | 11.1.13-h16 |
11.1.8 to 11.1.10-h* | 11.1.10-h36 |
11.1.7 to 11.1.7-h* | 11.1.7-h12 |
11.1.5 to 11.1.6-h* | 11.1.6-h40 |
11.1.0 to 11.1.4-h* | 11.1.4-h38 |
10.2.17 to 10.2.18-h* | 10.2.18-h13 |
10.2.14 to 10.2.16-h* | 10.2.16-h12 |
10.2.11 to 10.2.13-h* | 10.2.13-h27 |
10.2.8 to 10.2.10-h* | 10.2.10-h42 |
10.2.0 to 10.2.7-h* | 10.2.7-h39 |
Releases older than these trains are unsupported and must move to a supported fixed version. Hotfix status per Brandefense; confirm against Palo Alto's advisory.
02CiscoASA / FTD VPN and Snort 3 fixesActive exploitation
Cisco: VPN flaw exploited, plus the Snort 3 hardening release
Status | CVE-2026-76418 actively exploited (denial of service). Upgrade now |
|---|---|
Issue 1 | CVE-2026-76418 (CVSS 8.6): crafted request to the SSL remote access VPN reloads ASA or FTD when secondary authentication is set on a tunnel group, including DefaultWEBVPNGroup |
Issue 2 | Snort 3 Security Hardening Release, 21 October (CVSS up to 9.0): FTD and Meraki MX, any configuration. Not exploited |
PHP2Shell | ASA, FTD and Meraki not affected |
FTD needs both fixes, so take whichever first fixed release is higher for your train. In practice that is the CVE-2026-76418 release.
FTD fixed releases
FTD train | Snort 3 fix | CVE-2026-76418 fix |
|---|---|---|
7.0 and earlier | 7.0.10 | 7.0.11 |
7.2 | 7.2.12 | 7.2.13 |
7.4 | 7.4.8 | 7.4.9 |
7.6 | 7.6.6 | 7.6.7 |
7.7 | 7.7.13 | 7.7.14 |
10.0 | 10.0.2 | 10.0.3 |
10.1 | 10.1.0 | 10.1.1 |
ASA fixed releases
ASA train | CVE-2026-76418 fix |
|---|---|
9.16 and earlier | 9.16.4.104 |
9.18 | 9.18.4.96 |
9.20 | 9.20.4.50 |
9.22 | 9.22.3.200 |
9.23 | 9.23.1.48 |
9.24 | 9.24.1.27 or 9.24.10.1 |
What to do
- Check whether any tunnel group, including DefaultWEBVPNGroup, uses secondary authentication. If it does, upgrade ASA or FTD to the fixed release above.
- If you cannot upgrade yet, apply Cisco's mitigation of disabling secondary authentication or the tunnel group list, after testing it.
- Review reload and crash history on VPN-terminating firewalls and raise any unexplained reloads with us.
- Upgrade Firewall Management Center first if needed, and confirm every Meraki MX is online in Dashboard so it has received the automatic Snort update.
Fixed releases per Rescana, based on Cisco's advisory. Use the Cisco Software Checker to find the combined fixed release for your version.
03FortinetFortiOS, FortiManager and FortiAnalyzerPatch before 10 November
Fortinet: patch before details go public on 10 November
Status | Fix available. No exploitation reported |
|---|---|
Issue | Critical and high-severity security hardening release, 22 October, found partly with frontier AI testing |
Affected | FortiOS 7.2, 7.4, 7.6 and 8.0 below the fixed releases, FortiManager and FortiAnalyzer |
PHP2Shell | FortiOS, FortiManager and FortiAnalyzer not affected |
Fortinet is still due to publish CVE numbers and full advisories on 10 November (Cyber Kendra). Once those are out, expect exploit work to start quickly, so finish upgrading before then.
Fixed product releases
Product | 8.0 | 7.6 | 7.4 | 7.2 |
|---|---|---|---|---|
FortiOS | 8.0.2 | 7.6.8 | 7.4.13 | 7.2.14 |
FortiManager and FortiAnalyzer | 8.0.2 | 7.6.8 | 7.4.12 | 7.2.13 |
What to do
- Run get system status on every FortiGate, including each HA member, and record the FortiOS version.
- Upgrade using Fortinet's upgrade path tool, in the usual order: FortiAnalyzer, then FortiManager, then FortiGates. FortiManager Cloud may need a manual update.
- Until then, make sure HTTPS and SSH admin access is off on internet-facing interfaces and admins are limited with trusted hosts. Running a branch not listed here? Talk to us before planning the upgrade.
04Check PointGateway portals, Spark and Jumbo HotfixesHotfix available
Check Point: hotfix out, Jumbo Hotfixes due 11 November
Status | Hotfix available. No exploitation reported against Check Point gateways |
|---|---|
Issue | PHP2Shell through gateway web portals such as Mobile Access and SSL Network Extender, and Spark (sk1000302) |
Timeline | Automatic mitigation by 22 October, hotfix on 23 October, Jumbo Hotfixes still scheduled for 11 November |
The hotfix needs a reboot and has no Live Patch. A built-in IPS signature also protects R82.20, even with the IPS blade switched off.
Version-specific guidance
Version | What to do |
|---|---|
R82.20 | No hotfix needed. Protected by the built-in IPS signature; keep Automatic Updates on |
Other supported releases | Install the sk1000302 hotfix through CPUSE, then reboot |
Spark (locally managed) | Use the R81.10.17 packages in sk1000302; upgrade end-of-support releases |
What to do
- Confirm Automatic Updates are on and the latest IPS update is installed.
- Remove any manual cp-httpd.conf mitigation first, as it can break portals and Jumbo Hotfix installs, then install the hotfix and reboot.
- Limit Gaia WebUI to management networks and turn off portals you do not use.
05HPE Juniper NetworkingOctober fixes and J-Web precautionsJ-Web status unconfirmed
HPE Juniper Networking: October fixes out, J-Web PHP2Shell status unconfirmed
Status | October fixes available. PHP2Shell impact on J-Web not yet confirmed. No exploitation reported |
|---|---|
Issue | October 2026 quarterly bulletins (14 October), including several CVSS 9.8 flaws |
PHP2Shell | J-Web runs on PHP. Check Juniper's status advisory JSA112681, last updated 29 October |
October vulnerabilities
CVE | Issue (and when it applies) |
|---|---|
CVE-2026-101954 | Unauthenticated device takeover through J-Web (9.8) |
CVE-2026-101986 | J-Web authentication bypass and privileged CGI execution (9.8) |
CVE-2026-33792 | SRX code execution or DoS where GRE tunnels are configured (9.8) |
CVE-2026-101950 | SRX packet forwarding crash where Secure Vector Routing is on (9.8) |
CVE-2026-102084 | SRX code execution from a malformed ADVPN peer message |
CVE-2026-102078/82/83/86 | SRX crashes (DNS over TCP, TLS resumption, Web Filtering, SecIntel) |
What to do
- Turn off J-Web if you do not use it (delete system services web-management). Otherwise allow it only from trusted management hosts and never on untrust zones.
- Run show version on every SRX, including both chassis cluster nodes, and upgrade to a release that fixes the October issues for your train. Fixed releases vary by issue, so check each bulletin.
- Treat J-Web as potentially exposed to PHP2Shell until Juniper confirms otherwise.
Dates coming up
Vendors have moved dates at short notice in both directions this autumn, so check the advisory before you plan work around them.
firewall patch timeline · 20 Oct to 11 Nov
Date | Vendor | What is expected |
|---|---|---|
10 November | Fortinet | CVE numbers, scores and full advisories for the 22 October release |
11 November | Check Point | Jumbo Hotfix releases that include the PHP2Shell fix |
Cisco publishes its bundled disclosures on a fixed schedule with seven days' notice; subscribe to Cisco Security Notifications so the next window does not catch you out.
The bottom line
The head start that early patches gave defenders has run out for Palo Alto and Cisco customers, and Fortinet's details go public next week. The firewalls that were compromised all had one thing in common: a management interface open to the internet. Close that door, confirm your versions, upgrade without waiting for a maintenance window, and check exposed devices for signs of intrusion.
If you would like help checking your estate, reviewing logs or scheduling upgrades, our security team is ready to talk by phone or video.
Need help with your firewall estate?
Talk to our security team about checking versions, reviewing logs and scheduling upgrades.
Sources and further reading
- Help Net Security: PHP2Shell and Fragnesia chained to root firewalls (updated 2 November)
- Dream: Chained PHP2Shell exploit roots 25 servers
- The Hacker News: Attackers exploit PHP2Shell in Palo Alto management interfaces
- Brandefense: PAN-OS PHP2Shell hotfix dates
- Rescana: Cisco ASA and FTD CVE-2026-76418
- Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75
- Cyber Kendra: Fortinet patches AI-found flaws
- SecurityWeek: PHP2Shell roots Palo Alto firewalls but fails against WordPress
- The Register: Custom PHP2Shell exploit rooted 25 servers
- Check Point and Juniper details carried over from our 28 October bulletin; no newer public updates were found.