· 6 min read · LNX Inc.

MSP Threat Briefing: November 1, 2026

Palo Alto confirms PHP2Shell rooted PAN-OS firewalls, a critical Linux TCP flaw has no Ubuntu or RHEL fix yet, and WordPress 7.1.4 is under attack.

A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn

CISA added nothing to its exploited list over the weekend. Three developments from late last week were not in earlier briefings and need action. Palo Alto Networks confirmed that the PHP2Shell root chain hit its own firewalls. A critical Linux kernel TCP flaw has no fixed Ubuntu or Red Hat kernel yet. And attackers began probing a WordPress core upgrade flaw within hours of the fix.

  1. Patch PAN-OS firewalls and Panorama to the fixed hotfix for your branch, and take the management interface off the internet.
  2. Find internet-facing Linux servers on Ubuntu, RHEL and Rocky. Apply the interim nftables filter where you can test it, and patch when kernels ship. Debian has fixed kernels now.
  3. Confirm every WordPress site is on 7.1.4 or its branch's backport, especially sites with automatic updates turned off.

1. Update: Palo Alto confirms the PHP2Shell root chain hit PAN-OS firewalls

This follows the October 29 briefing. That briefing reported Dream Research's account of 25 rooted systems on an unnamed vendor's firewalls. Palo Alto's Unit 42 updated its threat brief on October 29. It says the targets were PAN-OS management interfaces exposed to the internet. Unit 42 says it independently verified the attacker's tooling and confirmed Dream's results.

Palo Alto's advisory for CVE-2026-109618 now lists exploit maturity as "ATTACKED". It covers CVE-2026-109619 as well. The advisory rates both 9.2 under CVSS 4.0, and both are already in CISA's catalog. Unit 42 says about 0.02% of Palo Alto's installed base had internet-facing management interfaces. Palo Alto says it contacted each affected customer individually.

Who is exposed. Clients with PA-Series or VM-Series firewalls, or Panorama, whose web management page or XML API is reachable from the internet. A data-plane interface counts if it has a management profile attached. GlobalProtect portals and gateways are not affected, per the advisory. Management is not exposed by default, so look for exceptions someone made for remote administration.

What to do.

  • Upgrade to the fixed hotfix for your branch. Examples from the advisory: 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4 and 10.2.18-h13. Older maintenance releases have their own hotfixes; check the advisory's table for yours.
  • On 11.2.10, note that 11.2.10-h16 carries only the PHP fix. 11.2.10-h17 also includes the Brotli fix.
  • Restrict management access to trusted internal addresses or a jump host. The advisory lists this as a mitigation alongside the patch.
  • With Threat Prevention, the advisory lists Threat ID 543004 and a set of signatures in the 976xx range. These need Applications and Threats content version 9162 or later.
  • Hunt on exposed devices. Unit 42 suggests searching threat logs for inbound vulnerability events from public addresses that match Threat ID 543004 or PHP2Shell signature names. It published no IP addresses or hashes.
  • If a firewall's management page was exposed before you patched, treat the firewall as suspect. Rotate the directory service accounts and admin credentials stored on it, then review Active Directory for unusual queries from the firewall's address.

2. Critical Linux kernel TCP flaw: Debian is fixed, Ubuntu and RHEL are not yet

CVE-2026-98432 is a use-after-free in the kernel's IPv4 TCP connection setup code. It goes back to kernel 4.4, per BleepingComputer. Red Hat and Ubuntu both list it at CVSS 9.8. An unauthenticated attacker triggers it with timed connection requests. The CVE was published October 15. It became urgent on October 27, when Anthropic reported a working remote root exploit against a server with a Multipath TCP (MPTCP) listener. Anthropic has not released the exploit. No vendor reports exploitation in the wild.

Patches are uneven. Red Hat's RHSB-2026-016, updated October 30, lists RHEL 8, 9 and 10 as affected with fixes still pending. Ubuntu lists 20.04 through 26.10 as vulnerable, with fixes in progress for 22.04 and later. Debian has shipped fixes, per its tracker.

Who is exposed. Internet-facing Linux servers: web and mail hosts, VPS instances, reverse proxies and appliances built on these distributions. MPTCP listeners matter because of the published research. Go programs built with Go 1.24 or later turn MPTCP on for listeners by default, per the Go documentation. CIQ notes that ordinary TCP also reaches the vulnerable code. Turning off MPTCP is not enough on its own.

What to do.

  • On Debian, install the fixed kernel and reboot: 6.1.190-1 (bookworm, DLA-4841-1), 6.12.113-1~deb12u1 (bookworm linux-6.12, DLA-4850-1) or 6.12.113-1 (trixie, DSA-6568-1).
  • On Ubuntu, RHEL and Rocky, watch for kernel updates over the coming days and schedule reboots now.
  • As a stopgap, Red Hat publishes an nftables rule that drops inbound IPv4 TCP packets carrying IP options. Normal traffic rarely uses IP options. Red Hat warns the rule may disrupt workloads and says to test it outside production first. It is not a substitute for patching.
table inet cve_2026_98432 {
    chain input {
        type filter hook input priority -310; policy accept;
        ip protocol tcp ip hdrlength > 5 counter drop
    }
}
  • Red Hat's steps: save it as cve-2026-98432.nft, check it with sudo nft --check --file cve-2026-98432.nft, then apply it with sudo nft --file cve-2026-98432.nft. Remove it with sudo nft delete table inet cve_2026_98432 after the patched kernel is running.
  • CIQ's guidance adds that a plain systemctl stop nftables removes the table. If you persist the rule, confirm it after firewall restarts.
  • Restrict which addresses can reach services that do not need to be public.

3. WordPress core upgrade flaw drew attacks within hours of the fix

WordPress released 7.1.4 on October 28 as a security release with 13 listed fixes. The most serious is a race condition in core updates. During a full-package update, files were unpacked into a predictable, web-reachable folder under wp-content/upgrade. That staged copy included the installer. An unauthenticated attacker who reached it in time could run code, according to the WordPress advisory.

WordPress rates the issue low. Wordfence scores it 8.1, as reported by The Hacker News. The Hacker News reports that Wordfence blocked 62,969 attack attempts in 24 hours. SecurityWeek reports that Wordfence's new firewall rule got its first hit nine minutes after deployment. Wordfence has not reported a successful compromise. The window lasts seconds, so attackers poll sites repeatedly and wait for an update.

Who is exposed. Any WordPress site from 4.7 through 7.1.3 that has not taken the fix. Sites with automatic background updates should already have it. The sites to check are the ones where someone turned auto-updates off, pinned a version, or runs updates by hand.

What to do.

  • Confirm the version on every site. Fixed releases include 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11 and 6.6.11. Every branch back to 4.7 has a backport; 4.7.39 is the oldest. The advisory lists them all.
  • The update itself is the exposure window. Run it soon, not in a nightly batch weeks from now.
  • Search web server logs for requests to PHP files under /wp-content/upgrade/, including paths ending in setup-config.php.
  • Check for administrator accounts, plugins or PHP files you did not create.
  • Plan upgrades for clients on old branches. WordPress says only the most recent version is actively supported.

Sources

threat-briefingmanaged-it

More from LNX

All posts →
A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn MSP Threat Briefing: October 31, 2026 CISA lists two more Ivanti Connect Secure flaws, a CVSS 10 GitLab bug and a Cisco ASA VPN crash as exploited. Federal deadlines start November 1. Read the post → A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn MSP Threat Briefing: October 29, 2026 CISA lists Fragnesia, a Linux kernel flaw chained with PHP2Shell to get root on firewalls. Federal deadline is October 31. ConnectWise starts restores. Read the post → A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn MSP Threat Briefing: October 28, 2026 CISA lists the Brotli decoder flaw and Adobe Commerce PolyShell as exploited. Both carry a November 10 federal deadline. Read the post →

Tell us what's in front of you.

A drawing set, a failing switch, an audit deadline, or a hunch that IT costs too much. We'll tell you who picks it up and what it takes.

Request a quote Book an assessment (833) 569-5690 · Mon–Fri 8–4