Chinese hackers are exploiting the PHP2Shell vulnerability just days after the PHP Foundation released patches on Oct. 21. The attacks target firewalls that run PHP, including Palo Alto Networks' PAN-OS, where all versions released before last Wednesday are vulnerable. Palo Alto has issued patches for all supported versions except 11.1.7-h12, due out Friday, and recommends restricting access to a jump box for the management interface. Dream, an Israeli cybersecurity firm, observed a Chinese AI-assisted campaign that used the FOFA search engine to identify 19,000 internet-exposed firewalls, queried version data on 5,000 devices, and selected 240 for targeting. The PHP2Shell flaws are CVE-2026-109618 and CVE-2026-109619, each with a CVSS v4 rating of 9.2. Meanwhile, the FBI seized the bulletproof-hosting domain virtualine.net and threat actors are scanning for the newly patched Oracle E-Business Suite flaw CVE-2026-101767. 1