Low Severity
CVE-2026-46300
Published: Nov 2, 2026
Reporting period: 25 October -1 November 2026 Focus: SOC operations, threat intelligence, vulnerability management, incident response, Splunk and Microsoft Defender XDR.
# Weekly-cybersecurity-and-SOC-digest-25-October-to-1-November-2026
**Reporting period:** 25 October -1 November 2026
**Focus:** SOC operations, threat intelligence, vulnerability management, incident response, Splunk and Microsoft Defender XDR.
This was a busy week. The most important development was the exploitation of PHP2Shell vulnerabilities in exposed firewall management interfaces, followed by privilege escalation to root. CISA also added several vulnerabilities affecting enterprise infrastructure to its Known Exploited Vulnerabilities (KEV) catalogue.
# 1. Critical threats and active exploitation
## 1.1 PHP2Shell and Fragnesia: attackers gain root access to firewalls
**Dates:** 26-29 October 2026
**Severity:** Critical
Two critical PHP vulnerabilities were exploited together with a Linux kernel vulnerability.
- **CVE-2026-109618:** PHP memory corruption vulnerability.
- **CVE-2026-109619:** PHP stale internal request-state vulnerability.
- **CVE-2026-46300:** Linux kernel privilege escalation, known as Fragnesia.
*CISA* added the two PHP vulnerabilities to its KEV catalogue on 26 October. It subsequently added Fragnesia on 28 October.
*Dream Research* reported that attackers compromised 25 servers, comprising 24 Palo Alto Networks firewalls and one internal management server, across the United States, Japan, Taiwan and South Korea.
The attackers reportedly used PHP2Shell for initial code execution and Fragnesia to obtain root privileges. Researchers also identified subsequent Active Directory reconnaissance and credential-related activity. Palo Alto Networks' Unit 42 independently verified the reported attacker tooling and results.
**Why it matters to a SOC analyst**
This demonstrates how an attacker can move from unauthenticated remote code execution to full system control using vulnerability chaining.
**What to investigate:**
- PHP worker processes launching unexpected shells.
- Unexpected PHP files or webshells in web directories.
- Unu