🎯 Exploit chaining

The items that name it 7

• PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
  article2026-10-30

  Attackers chained a PHP2Shell exploit for PAN-OS with a Fragnesia kernel privilege escalation exploit to deploy webshells with root privileges.

• CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
  article2026-10-29

  Attackers chain PHP2Shell (CVE-2026-109618/CVE-2026-109619) with Fragnesia to implant PHP webshells and run commands as root.

• China-Linked Hackers Exploit PHP2Shell to Root Firewalls
  article2026-10-28It is written here as Exploit chaining: PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619) with Fragnesia (CVE-2026-46300) for root access.

  CVE-2026-109618, CVE-2026-109619

• How bug bounty sharpens one researcher’s security skills
  article2026-10-22It is written here as Exploit chaining (combining low-impact bugs, for example an open redirect with an allowlisted-domain SSRF that follows redirects).

  combining low-impact bugs, for example an open redirect with an allowlisted-domain SSRF that follows redirects

• [tl;dr sec] #350 - Reverse Engineer Anything, Tracking AI-integrated Malware, Test-driving Jev
  article2026-10-15It is written here as Exploit chaining (full-chain exploit).

  XBOW combined a V8 compiler bug, an animated-WebP decoder bug and a Crashpad memory-safety bug to escape the Chrome renderer sandbox.

• Frontier models found the vulnerabilities. Only the attacker found the chains.
  article2026-10-07

  Combining individually reported findings (e.g., SSRF + hardcoded secret) into a full, runtime-confirmed attack path; requires reaching each step through the running application, which source-code-only review cannot confirm

• Socket: When Autonomous Agents Escape
  article2026-08-30

  HDF5 file-handling flaw chained with a Jinja2 template-injection zero-day to execute code on 41 production workers