Palo Alto Networks
CompanyFacts
- Country
- United StatesSource: Wikidata
- Founded
- 2005Source: Wikidata
- Sector
- Computer securitySource: Wikidata
- Official website
- www.paloaltonetworks.comSource: Wikidata
Security timeline
- Named in breach reports by GBHackersHackers chain PHP2Shell and Fragnesia flaws to gain root on Palo Alto firewalls
- Activity reported by Cybersecurity DivePalo Alto Networks firewalls compromised in chained attacks using PHP2Shell
- Vulnerability reported by SecurityWeekPHP2Shell attacks root Palo Alto firewalls but fail against WordPress
- Vulnerability reported by CSO OnlineCritical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
Recent news
Hackers chain PHP2Shell and Fragnesia flaws to gain root on Palo Alto firewalls
Attackers chained critical PHP2Shell remote code execution flaws with the Fragnesia Linux kernel flaw to gain root access on PAN-OS systems. The campaign reportedly compromised 24 internet-facing firewalls before reaching an internal firewall management server, bringing the total to 25 systems, according to Hunt.io's investigation citing Dream Research's analysis.
Palo Alto Networks firewalls compromised in chained attacks using PHP2Shell
Cybersecurity Dive reports that Palo Alto Networks firewalls were compromised in chained attacks that used PHP2Shell. The AI-enabled campaign hit two dozen targets, including sites linked to the U.S. government. The article excerpt gives no further technical detail.
PHP2Shell attacks root Palo Alto firewalls but fail against WordPress
Critical PHP vulnerabilities, referred to as PHP2Shell, have been targeted in attacks for over a week. The attacks have gained root access on Palo Alto firewalls but failed against WordPress. Around 22.6 million exposed instances are potentially affected.
Critical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
CVE-2026-111497, nicknamed Broccoli2Shell, is an out-of-bounds write in the Google Brotli decoder that can be exploited remotely without authentication. It can cause memory corruption, information disclosure, crashes or code execution. CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October 2026. Software that bundles Brotli, including Node.js, .NET, PowerShell, Bun, Envoy Proxy, Istio and Python packages, may be affected.