# MSP Threat Briefing: November 1, 2026

_November 1, 2026 · LNX Inc._

Palo Alto confirms PHP2Shell rooted PAN-OS firewalls, a critical Linux TCP flaw has no Ubuntu or RHEL fix yet, and WordPress 7.1.4 is under attack.

CISA added nothing to its exploited list over the weekend. Three developments from late last week were not in earlier briefings and need action. Palo Alto Networks confirmed that the PHP2Shell root chain hit its own firewalls. A critical Linux kernel TCP flaw has no fixed Ubuntu or Red Hat kernel yet. And attackers began probing a WordPress core upgrade flaw within hours of the fix.

1. Patch PAN-OS firewalls and Panorama to the fixed hotfix for your branch, and take the management interface off the internet.
2. Find internet-facing Linux servers on Ubuntu, RHEL and Rocky. Apply the interim nftables filter where you can test it, and patch when kernels ship. Debian has fixed kernels now.
3. Confirm every WordPress site is on 7.1.4 or its branch's backport, especially sites with automatic updates turned off.

## 1. Update: Palo Alto confirms the PHP2Shell root chain hit PAN-OS firewalls

This follows the [October 29 briefing](/news/msp-threat-briefing-2026-10-29/). That briefing reported Dream Research's account of 25 rooted systems on an unnamed vendor's firewalls. Palo Alto's Unit 42 updated its [threat brief](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/) on October 29. It says the targets were PAN-OS management interfaces exposed to the internet. Unit 42 says it independently verified the attacker's tooling and confirmed Dream's results.

Palo Alto's [advisory for CVE-2026-109618](https://security.paloaltonetworks.com/CVE-2026-109618) now lists exploit maturity as "ATTACKED". It covers CVE-2026-109619 as well. The advisory rates both 9.2 under CVSS 4.0, and both are already in CISA's catalog. Unit 42 says about 0.02% of Palo Alto's installed base had internet-facing management interfaces. Palo Alto says it contacted each affected customer individually.

**Who is exposed.** Clients with PA-Series or VM-Series firewalls, or Panorama, whose web management page or XML API is reachable from the internet. A data-plane interface counts if it has a management profile attached. GlobalProtect portals and gateways are not affected, per the advisory. Management is not exposed by default, so look for exceptions someone made for remote administration.

**What to do.**

- Upgrade to the fixed hotfix for your branch. Examples from the advisory: 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4 and 10.2.18-h13. Older maintenance releases have their own hotfixes; check the advisory's table for yours.
- On 11.2.10, note that 11.2.10-h16 carries only the PHP fix. 11.2.10-h17 also includes the Brotli fix.
- Restrict management access to trusted internal addresses or a jump host. The advisory lists this as a mitigation alongside the patch.
- With Threat Prevention, the advisory lists Threat ID 543004 and a set of signatures in the 976xx range. These need Applications and Threats content version 9162 or later.
- Hunt on exposed devices. Unit 42 suggests searching threat logs for inbound vulnerability events from public addresses that match Threat ID 543004 or PHP2Shell signature names. It published no IP addresses or hashes.
- If a firewall's management page was exposed before you patched, treat the firewall as suspect. Rotate the directory service accounts and admin credentials stored on it, then review Active Directory for unusual queries from the firewall's address.

## 2. Critical Linux kernel TCP flaw: Debian is fixed, Ubuntu and RHEL are not yet

CVE-2026-98432 is a use-after-free in the kernel's IPv4 TCP connection setup code. It goes back to kernel 4.4, per [BleepingComputer](https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/). [Red Hat](https://access.redhat.com/security/cve/cve-2026-98432) and [Ubuntu](https://ubuntu.com/security/CVE-2026-98432) both list it at CVSS 9.8. An unauthenticated attacker triggers it with timed connection requests. The CVE was published October 15. It became urgent on October 27, when [Anthropic reported](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude) a working remote root exploit against a server with a Multipath TCP (MPTCP) listener. Anthropic has not released the exploit. No vendor reports exploitation in the wild.

Patches are uneven. Red Hat's [RHSB-2026-016](https://access.redhat.com/security/vulnerabilities/RHSB-2026-016), updated October 30, lists RHEL 8, 9 and 10 as affected with fixes still pending. Ubuntu lists 20.04 through 26.10 as vulnerable, with fixes in progress for 22.04 and later. Debian has shipped fixes, per its [tracker](https://security-tracker.debian.org/tracker/CVE-2026-98432).

**Who is exposed.** Internet-facing Linux servers: web and mail hosts, VPS instances, reverse proxies and appliances built on these distributions. MPTCP listeners matter because of the published research. Go programs built with Go 1.24 or later turn MPTCP on for listeners by default, per the [Go documentation](https://go.dev/doc/godebug). CIQ notes that ordinary TCP also reaches the vulnerable code. Turning off MPTCP is not enough on its own.

**What to do.**

- On Debian, install the fixed kernel and reboot: 6.1.190-1 (bookworm, DLA-4841-1), 6.12.113-1~deb12u1 (bookworm linux-6.12, DLA-4850-1) or 6.12.113-1 (trixie, DSA-6568-1).
- On Ubuntu, RHEL and Rocky, watch for kernel updates over the coming days and schedule reboots now.
- As a stopgap, Red Hat publishes an nftables rule that drops inbound IPv4 TCP packets carrying IP options. Normal traffic rarely uses IP options. Red Hat warns the rule may disrupt workloads and says to test it outside production first. It is not a substitute for patching.

```
table inet cve_2026_98432 {
    chain input {
        type filter hook input priority -310; policy accept;
        ip protocol tcp ip hdrlength > 5 counter drop
    }
}
```

- Red Hat's steps: save it as `cve-2026-98432.nft`, check it with `sudo nft --check --file cve-2026-98432.nft`, then apply it with `sudo nft --file cve-2026-98432.nft`. Remove it with `sudo nft delete table inet cve_2026_98432` after the patched kernel is running.
- [CIQ's guidance](https://kb.ciq.com/article/security-advisories/cve-2026-98432-mitigation) adds that a plain `systemctl stop nftables` removes the table. If you persist the rule, confirm it after firewall restarts.
- Restrict which addresses can reach services that do not need to be public.

## 3. WordPress core upgrade flaw drew attacks within hours of the fix

WordPress released [7.1.4](https://wordpress.org/news/2026/10/wordpress-7-1-4/) on October 28 as a security release with 13 listed fixes. The most serious is a race condition in core updates. During a full-package update, files were unpacked into a predictable, web-reachable folder under `wp-content/upgrade`. That staged copy included the installer. An unauthenticated attacker who reached it in time could run code, according to the [WordPress advisory](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg).

WordPress rates the issue low. Wordfence scores it 8.1, as reported by [The Hacker News](https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html). The Hacker News reports that Wordfence blocked 62,969 attack attempts in 24 hours. [SecurityWeek](https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/) reports that Wordfence's new firewall rule got its first hit nine minutes after deployment. Wordfence has not reported a successful compromise. The window lasts seconds, so attackers poll sites repeatedly and wait for an update.

**Who is exposed.** Any WordPress site from 4.7 through 7.1.3 that has not taken the fix. Sites with automatic background updates should already have it. The sites to check are the ones where someone turned auto-updates off, pinned a version, or runs updates by hand.

**What to do.**

- Confirm the version on every site. Fixed releases include 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11 and 6.6.11. Every branch back to 4.7 has a backport; 4.7.39 is the oldest. The [advisory](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg) lists them all.
- The update itself is the exposure window. Run it soon, not in a nightly batch weeks from now.
- Search web server logs for requests to PHP files under `/wp-content/upgrade/`, including paths ending in `setup-config.php`.
- Check for administrator accounts, plugins or PHP files you did not create.
- Plan upgrades for clients on old branches. WordPress says only the most recent version is actively supported.

## Sources

- [Unit 42: threat brief on CVE-2026-109618 and CVE-2026-109619, updated October 29, 2026](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/)
- [Palo Alto Networks advisory: CVE-2026-109618](https://security.paloaltonetworks.com/CVE-2026-109618)
- [Red Hat: CVE-2026-98432](https://access.redhat.com/security/cve/cve-2026-98432)
- [Red Hat security bulletin RHSB-2026-016](https://access.redhat.com/security/vulnerabilities/RHSB-2026-016)
- [Ubuntu: CVE-2026-98432](https://ubuntu.com/security/CVE-2026-98432)
- [Debian security tracker: CVE-2026-98432](https://security-tracker.debian.org/tracker/CVE-2026-98432)
- [CIQ: CVE-2026-98432 mitigation](https://kb.ciq.com/article/security-advisories/cve-2026-98432-mitigation)
- [Anthropic: discovering vulnerabilities with Claude](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude)
- [Go documentation: GODEBUG settings](https://go.dev/doc/godebug)
- [BleepingComputer: critical Linux kernel flaw allows remote root attacks on MPTCP servers](https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/)
- [WordPress 7.1.4 security release](https://wordpress.org/news/2026/10/wordpress-7-1-4/)
- [WordPress advisory GHSA-4w3m-c66w-69mg](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg)
- [The Hacker News: WordPress RCE flaw draws nearly 63,000 attack attempts](https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html)
- [SecurityWeek: fresh WordPress vulnerability in attackers' crosshairs](https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/)