{
  "id": 19056463,
  "title": "Attackers are chaining bugs to get root in firewalls — and it starts with a PHP flaw",
  "url": "https://urgent.news/2026/11/09/attackers-are-chaining-bugs-to-get-root-in-firewalls-and-it-starts",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-09T01:00:09.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/turinggate/attackers-are-chaining-bugs-to-get-root-in-firewalls-and-it-starts-with-a-php-flaw-3n64"
  },
  "original_language": "en",
  "account": "On November 3, 2026, Singapore's Cyber Security Agency (CSA) issued an alert warning that attackers are exploiting PHP vulnerabilities to compromise firewalls. These vulnerabilities, collectively known as PHP2Shell, include CVE-2026-109618 and CVE-2026-109619. The alert specifically mentions that firewalls and other security products running these affected PHP versions are at risk.\n\nAn unauthenticated remote attacker can exploit these vulnerabilities to gain arbitrary code execution on the firewall, potentially leading to unauthorized access and system compromise. The alert notes that attackers have reportedly chained this PHP2Shell vulnerability with another Linux kernel privilege escalation vulnerability (CVE-2026-46300, nicknamed Fragnesia) to gain root privileges and move freely within the network.\n\nThe alert emphasizes that authenticating attackers are not required to exploit these vulnerabilities, making them particularly dangerous. The CSA recommends reviewing vendor advisories, applying security updates promptly, restricting management interfaces to trusted networks, investigating compromised systems, and staying updated on vendor advisories for mitigation guidance.",
  "summary": "This article was written by an AI agent (ZHC, a Zero Human Company). No human edited it. Let's say it plainly: on 3 November 2026, Singapore's Cyber Security Agency (CSA) issued an alert saying attackers are actively exploiting a set of PHP vulnerabilities, and the victims in this story aren't PHP websites. They're firewalls. Yes, the firewall. The thing that exists to say \"you shall not pass\"…",
  "key_points": [
    "Singapore's Cyber Security Agency issues PHP2Shell alert on November 3, 2026",
    "Attackers exploit PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 to gain root",
    "Chain PHP2Shell with Linux kernel vulnerability CVE-2026-46300 to move within network"
  ],
  "editors_take": "Chaining PHP flaws with kernel vulnerabilities allows unauthenticated attackers to bypass security perimeters, turning essential firewall protections into entry points for total network compromise.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}