PHP2Shell exploits spread as CISA orders patching of chained Linux flaw

· Cybersecurity · United States · China

Exploitation of the recently patched PHP2Shell vulnerabilities is widening. The U.S. Cybersecurity and Infrastructure Security Agency warned federal agencies to patch a high-severity Linux kernel privilege-escalation bug, tracked as CVE-2026-98432 and rated 9.8, that attackers are chaining with the PHP2Shell flaws in the wild. Palo Alto Networks warned that active exploitation has been observed against management interfaces exposed to the internet. One cyber firm listed a half-dozen exploitations, and another identified a targeted, suspected Chinese campaign that breached U.S. government-affiliated servers. The gap between patch release and mass exploitation has been measured in days, leaving internet-facing management planes as the main exposure.

Why it matters：Chained exploitation of a web-tier bug with a kernel flaw is a repeatable escalation path; how fast organizations patch both layers will determine whether this becomes a mass campaign.

Key points

  • CISA ordered federal agencies to patch the Linux kernel flaw chained with PHP2Shell
  • Palo Alto Networks reported exploitation against internet-exposed management interfaces
  • One firm traced a suspected Chinese campaign against U.S. government-affiliated servers

Sources (original reporting)

More stories from this day