Weekly Threat Bulletin - November 4th, 2026
F5, Wednesday, November 4th, 2026
F5's weekly bulletin leads with attackers chaining PHP2Shell RCE flaws and the Fragnesia kernel bug to compromise 25 PAN-OS systems.
F5's threat bulletin for November 4, 2026 reports that threat actors compromised 25 Palo Alto Networks PAN-OS systems, including 24 perimeter firewalls and one internal management server.
They chained the critical PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619 with the Fragnesia Linux kernel privilege escalation flaw CVE-2026-46300 to gain root.
The attackers then set up a persistent reverse SSH tunnel into a US government-affiliated environment and harvested directory-service credentials.
Recommended mitigations include applying vendor PAN-OS fixes, updating PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or temporarily disabling session.upload_progress.enabled.