F5 Labs bulletin: PAN-OS compromises, PHP2Shell, DeadTag and a TeamViewer flaw

A dark server room with blue-lit firewall racks, some glowing red with creeping tendrils, and a flashlight on cracked padlocks and tools on a workbench. — AI-generated illustration created for TribeAI with Google Flow (model nano2); text-to-image, no third-party image used as input.

Compromised PAN-OS systems and several vulnerabilities

This explainer summarizes what the bulletin reports. The bulletin is the only source used here. The dates of the individual events are not given in the material reviewed for this article.

Source: the F5 Labs weekly threat bulletin.

Compromised Palo Alto Networks PAN-OS systems

According to the bulletin, threat actors compromised 25 Palo Alto Networks PAN-OS systems. These included 24 perimeter firewalls and one internal management server.

In the PAN-OS campaign, the attackers used the Fragnesia flaw (CVE-2026-46300) to escalate privileges to root.

The PHP2Shell vulnerabilities

The bulletin says the PHP2Shell vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. They have a CVSS 4.0 rating of 9.2.

The DeadTag toolkit

The bulletin describes a toolkit called DeadTag. It generates approximately 135 million monthly visits by acquiring expired ad-industry domains.

Requests targeting WordPress staging paths

The bulletin reports that more than 18,500 requests targeted the WordPress staging paths within 21 hours of the patch release. It also states that no successful compromises have been reported.

A TeamViewer client vulnerability

CVE-2026-111585 has a CVSS score of 8.8, according to the bulletin. It affects the remote-control screen decompression component of TeamViewer clients.

Limits of this article

This article is educational information that summarizes a single published threat bulletin.

It is not investment advice and does not recommend any product or vendor.

It does not cover patch instructions, affected versions or remediation steps.

It does not independently verify the reported findings.

Sources & evidence

F5 Labs Weekly Threat Bulletin - November 4th, 2026 ↗
Threat actors compromised 25 Palo Alto Networks PAN-OS systems, including 24 perimeter firewalls and one internal management server.; The PHP2Shell vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and have a CVSS 4.0 rating of 9.2.; In the PAN-OS campaign, the attackers used the Fragnesia flaw (CVE-2026-46300) to escalate privileges to root.; The DeadTag toolkit generates approximately 135 million monthly visits by acquiring expired ad-industry domains.; More than 18,500 requests targeted the WordPress staging paths within 21 hours of the patch release, and no successful compromises have been reported.; CVE-2026-111585 has a CVSS score of 8.8 and affects the remote-control screen decompression component of TeamViewer clients.
November 5, 2026