Weekly Threat Bulletin – November 4th, 2026

PHP2Shell RCE Vulnerabilities (CVE-2026-109618/19) and Fragnesia (CVE-2026-46300) Chained to Compromise Palo Alto PAN-OS Firewalls

Threat actors have compromised 25 Palo Alto Networks PAN-OS systems, including 24 perimeter firewalls and one internal management server, by chaining the critical PHP2Shell remote code execution (RCE) vulnerabilities with the Fragnesia Linux kernel privilege escalation flaw. The PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS 4.0 rating of 9.2, exploit PHP's session-upload handling and heap allocations to bypass address space layout randomization (ASLR) and execute arbitrary code via the `system()` function. In this campaign, the attackers utilized a custom exploit tailored to the uniform PHP 8.0.30 build of the PAN-OS appweb management server, subsequently leveraging the Fragnesia flaw (CVE-2026-46300) to escalate privileges to root. Upon gaining access, the operators established a persistent reverse SSH tunnel into a United States government-affiliated environment, allowing them to pivot internally and harvest directory-service credentials. To mitigate these threats, organizations must apply vendor-supported PAN-OS remediations, update standalone PHP deployments to versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or temporarily disable `session.upload_progress.enabled` to block the upload-progress attack path.

Threat Details and IOCs

Immediately apply the security updates provided by Palo Alto Networks to remediate the PHP2Shell (CVE-2026-109618, CVE-2026-109619) and Fragnesia (CVE-2026-46300) vulnerabilities on all PAN-OS firewalls.

Apply the latest available kernel security updates to all Linux systems to patch the Fragnesia privilege escalation vulnerability (CVE-2026-46300).

Update all standalone PHP deployments on web servers to a patched version (e.g., 8.2.35, 8.3.36, or newer) to mitigate the PHP2Shell RCE vulnerability.

If immediate patching of PHP servers is not possible, temporarily mitigate the PHP2Shell vulnerability by disabling 'session.upload_progress.enabled' in the php.ini configuration file.

Add all IP addresses listed in the article's IOC table to the firewall blocklist to prevent inbound and outbound communication with known malicious infrastructure.

Initiate threat hunting queries in your SIEM or EDR to for web server processes (e.g., appweb, httpd, nginx) that have spawned shell processes (e.g., sh, bash, cmd.exe).

Scan all relevant systems, particularly web servers and firewall management servers, for the presence of the files 'panos_rce_poc.py' and 'prce.py'.

Compliance Best Practices

Develop and implement a project to ensure no firewall or network device management interfaces are exposed to the public internet. All management access must be restricted to a secure, internal-only management network, accessible only via VPN or a bastion host.

Implement a default-deny egress traffic policy on the firewall. Create explicit allow rules only for known, required outbound protocols and destinations for servers, especially those in DMZ or management zones.

Review and enhance network segmentation policies to create isolated security zones for critical infrastructure. Enforce strict access control lists (ACLs) between the internet-facing DMZ, internal management networks, and user networks.

Establish a formal vulnerability management program that includes automated asset discovery, continuous vulnerability scanning, risk-based prioritization of findings, and defined Service Level Agreements (SLAs) for remediation.

DeadTag Toolkit Leveraged to Deploy Coruna and DarkSword Zero-Click Spyware on iOS Devices via PrestaShop Exploits, Targeting Crypto Wallets

A dark web traffic-brokering toolkit active since spring 2026, known as DeadTag, is generating approximately 135 million monthly visits by acquiring expired ad-industry domains and modifying their embedded tracking tags across thousands of legitimate websites. While most operators use this infrastructure to redirect users to low-level scams, a threat actor group dubbed the "iPhone exploit crew" leverages DeadTag and compromised PrestaShop e-commerce sites to deploy highly sophisticated, zero-click iOS spyware named Coruna and DarkSword. This spyware, which targets vulnerable iOS versions, is designed to exfiltrate device information, keychain secrets, and credentials from major cryptocurrency wallets, including Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink, and Bitpie. The attack infrastructure heavily features Chinese-language elements, and mitigation requires website owners to audit third-party scripts and implement Content Security Policies, while end-users must keep iOS devices updated, utilize multi-factor authentication, and consider enabling iOS Lockdown Mode.

Threat Details and IOCs

Using your Mobile Device Management (MDM) solution, enforce an immediate update of all corporate-owned and BYOD iPhones to the latest available iOS version.

Add the known DeadTag and spyware-related domains (e.g., ad-track[.]live, cdn[.]gotoiphone[.]com, mzpo30[.]cam, ecomtrack[.]io) to your network firewall, DNS filter, and web proxy blocklists.

Instruct the web development team to immediately audit all public-facing company websites for abandoned third-party scripts and remove any code that links to expired or unused services.

Identify high-risk employees, such as executives and finance personnel, and instruct them to enable Lockdown Mode on their iPhones to significantly reduce the attack surface against zero-click exploits.

Send a security alert to all employees warning them malvertising campaigns that cause unexpected browser redirects. Instruct them to immediately close the browser tab and report the incident if it occurs.

Compliance Best Practices

Develop and implement a strict Content Security Policy (CSP) for all company websites to whitelist approved sources for scripts, thereby preventing the execution of malicious code from unauthorized or compromised third-party domains.

Implement or configure a Mobile Device Management (MDM) solution to enforce security policies, such as requiring a device PIN, setting a minimum OS version, and automatically installing security updates on all enrolled mobile devices.

Deploy a network-level DNS filtering or secure web gateway solution to block categories like advertising, scams, and known malicious sites for all users on the corporate network.

Establish and enforce a corporate policy that requires multi-factor authentication (MFA) on all business-related financial, cloud, and cryptocurrency applications to prevent account takeover even if a device is compromised.

Establish a continuous security awareness training program that includes modules on mobile security, identifying malvertising, and reporting suspicious browser behavior and phishing attempts.

Active Exploitation Targets WordPress Core Unauthenticated Race Condition Leading to Remote Code Execution

Threat actors are actively attempting to exploit a newly patched, high-severity unauthenticated race condition in the WordPress Core update process that can lead to remote code execution. Patched on October 28, 2026, in WordPress version 7.1.4 and backported to legacy branches down to version 4.7, the vulnerability stems from predictable, web-accessible staging paths used during full-package upgrades. To successfully execute an attack, threat actors must target a narrow, seconds-long window while WordPress unpacks a complete Core update, specifically polling for staged `setup-config.php` installer paths. Security telemetry indicates rapid exploitation attempts, with over 18,500 requests targeting these paths within 21 hours of the patch release, though no successful compromises have been reported. The WordPress 7.1.4 update mitigates this flaw by randomizing the staging directory, adding an index guard, and preventing the unsafe promotion of staged configuration data, while also addressing 22 other security defects, including cross-site scripting (XSS) and authorization weaknesses.

Threat Details and IOCs

Immediately update all WordPress instances to version 7.1.4 or the latest patched version available for your specific branch.

Ensure your Web Application Firewall (WAF) has up-to-date rules to block requests targeting `setup-config.php` in WordPress staging directories like `wp-content/upgrade/`.

Scan web server access logs for requests targeting `setup-config.php` within the `wp-content/upgrade/` directory to identify attempted or successful exploitation.

Compliance Best Practices

Implement and configure an automated patch management system for all WordPress sites to ensure critical security updates are applied as soon as they are released.

Harden web server configurations to deny direct web access to sensitive WordPress directories, such as `wp-content/upgrade/` and `wp-content/uploads/`, unless explicitly required.

Deploy a File Integrity Monitoring (FIM) solution to alert on unexpected file creation or modification within the WordPress file system.

Establish a formal vulnerability management program that includes subscribing to security advisories for all critical software, including WordPress, to ensure timely awareness and risk assessment of new vulnerabilities.

Apache Struts2 Core Arbitrary Code Execution via OGNL Sandbox Escape

Apache Struts2 Core versions 7.4.0 and below are vulnerable to arbitrary code execution via an Object-Graph Language (OGNL) sandbox escape. While the platform attempts to restrict OGNL execution using `SecurityMemberAccess`, these protections only guard against immediate calls evaluated by the OGNL engine. Attackers can bypass these restrictions by leveraging allowed calls that accept nested arguments and internally invoke reflection, executing outside the scope of the cursory protections. In versions 6.x and below, which rely primarily on blacklists, attackers can execute arbitrary code by embedding reflective calls within non-blacklisted classes such as `java.beans.Statement` and `java.beans.Expression`. In version 7.x, which utilizes a whitelist-based approach, exploitation requires an explicitly whitelisted wrapper class to execute the nested call. This vulnerability allows attackers to bypass class, method, static, and non-static checks to execute arbitrary system commands, as demonstrated by the payload: `GET / .action?query=new java.beans.Expression(new java.beans.Expression(@java.lang.ProcessBuilder@class,'new',new Object[]{new String[]{'/bin/sh','-c','id > >'}}).getValue(),'start',new Object[0]).getValue()`.

Threat Details and IOCs

Identify all systems running Apache Struts2 and upgrade the Struts2 Core library to a version higher than 7.4.0 as soon as a patch is released.

For systems running Apache Struts2 version 6.x or below, add `java.beans.Statement` and `java.beans.Expression` to the `struts.excludedClasses` configuration setting to block the exploit.

For systems running Apache Struts2 version 7.x, audit the `struts.allowlist.classes` configuration and immediately remove any dangerous reflection-enabling classes, specifically ensuring `java.beans.Statement` and `java.beans.Expression` are not present.

Configure your Web Application Firewall (WAF) to create rules that detect and block HTTP requests containing the strings 'java.beans.Expression' or 'java.beans.Statement' within URL parameters or the request body.

Using your SIEM or log management platform, historical web server access logs for requests containing the strings 'java.beans.Expression' or 'java.beans.Statement' to identify potential past or ongoing exploitation.

Compliance Best Practices

Implement and maintain a comprehensive software asset inventory, including a Software Bill of Materials (SBOM), for all applications to enable rapid identification of vulnerable components like Apache Struts2 in the future.

Review and reconfigure all web application service accounts to run with the minimum necessary permissions, ensuring they cannot execute system-level commands or access sensitive files and directories outside of the application's intended scope.

Deploy and tune an Endpoint Detection and Response (EDR) solution on all web servers to detect and alert on anomalous process creation, such as a Java application process spawning a command shell (e.g., sh, bash, cmd.exe, powershell.exe).

Establish a mandatory security training program for developers that specifically covers the risks of insecure framework configurations, such as the dangers of overly permissive whitelisting in Apache Struts2.

Isolate public-facing web servers in a dedicated network zone (DMZ) with strict firewall rules that restrict traffic to and from the internal corporate network, limiting the potential for lateral movement after a compromise.

CVE-2026-111585: Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow

A high-severity integer overflow vulnerability, tracked as CVE-2026-111585 with a CVSS score of 8.8, exists in the remote-control screen decompression component of TeamViewer clients, including the Full Client, Portable, and Remote Control App prior to version 15.83. The security flaw occurs within the `CBitmapBuffer` constructor when processing attacker-controlled display parameters, such as a width and height of 0x8000 and a stride of 0x20040. This causes a 32-bit plane size calculation to wrap, allocating only 4 MB instead of the required 4.3 GB, which allows a subsequent XOR-RLE tile decoder operation with a crafted run record to execute an out-of-bounds write. This heap-based buffer overflow can result in a denial of service via process crash (SIGSEGV) or potential arbitrary code execution with the privileges of the viewer process. Successful exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host, affecting various legacy versions across Windows, Linux, and macOS, with remediation requiring an upgrade to version 15.83 or patched legacy releases.

Threat Details and IOCs

Use asset inventory, endpoint detection and response (EDR), or vulnerability scanning tools to identify all systems with TeamViewer Full Client, Portable, or Remote Control App installed.

Upgrade all identified TeamViewer installations to version 15.83 or newer. For legacy systems, upgrade to the specific patched versions listed in the advisory (e.g., 15.64.10 for Legacy Windows 7 & 8).

Issue an immediate security bulletin to all employees instructing them not to use TeamViewer to connect to any unknown or unsolicited remote hosts.

If immediate patching is not feasible, configure the corporate firewall to temporarily block outbound TCP/UDP traffic on port 5938 to prevent connections to external TeamViewer hosts.

Compliance Best Practices

Implement or improve a centralized software and patch management system to automate the deployment of security updates for all third-party applications across all endpoints.

Implement an application control or whitelisting policy using an EDR or similar tool to restrict the execution of unauthorized applications, including portable versions of remote access software.

Implement a default-deny egress filtering policy on the network firewall, explicitly allowing only outbound traffic required for legitimate business purposes.

Conduct a formal review of all remote access tools in use, standardize on a minimal set of approved solutions, and create a process to decommission unauthorized software.

Authors & Contributors

F5 Labs Staff (Author)

Threat Research Team,