Search — “CVE-2026-0322”

An Eclypsium InfraTrust Pulse report (covering September 18 to October 14) lists actively exploited vulnerabilities across network appliances and warns that PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) affect PHP embedded in appliance management interfaces. Because vendors compile PHP into firmware, customers must wait for vendor firmware updates. InfraTrust recommends keeping PHP-backed management interfaces off the Internet until patches arrive; the sources do not describe confirmed PHP2Shell exploitation in the wild.

Palo Alto Networks confirmed limited active exploitation of CVE-2026-0322, a CVSS 8.6 PAN-OS management-interface flaw that lets authenticated attackers with network access execute code as root on PA-Series, VM-Series, and Panorama appliances. Attackers need existing credentials and network access to the management interface, and the vendor says there are no workarounds beyond Threat Prevention signatures with limited coverage. Hunters should check management-interface exposure and review firewall activity for the three published exploiting IP addresses, and CISA has added the CVE to the KEV catalog.