Nice2GeekYou

Attackers Are Taking Over Firewalls Through Their Admin Pages: Get Yours Off the Internet

CISA confirmed on October 28, 2026 that attackers are chaining the PHP2Shell flaws with a Linux kernel bug called Fragnesia to take full control of firewalls whose web management page is exposed to the internet. Cisco also patched an actively exploited VPN flaw that can crash ASA and FTD firewalls. Here's what a small business should check this week.

  • firewall
  • vpn
  • network-security
  • php2shell
  • fragnesia
  • cisco
  • patching
  • smb
  • managed-it

If anyone can reach your firewall's login page from the internet, fix that this week. On October 28, 2026, CISA added a Linux kernel flaw nicknamed "Fragnesia" (CVE-2026-46300) to its list of vulnerabilities attackers are actively using, and noted it is being chained with the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to plant hidden back doors and run commands as root. Researchers at Dream Research reported that this chain was used against firewalls with their web management page exposed, taking full control of 25 devices on October 23 and 24.

Why it matters

Many firewalls, VPN gateways and network storage boxes run PHP inside their management web page. Eclypsium's October InfraTrust report points out that owners usually can't patch that PHP themselves. They have to wait for the vendor to ship new firmware. Until then, an admin page reachable from the internet is an open invitation.

The same week, Cisco patched an actively exploited flaw (CVE-2026-76418) in the SSL VPN of its Secure Firewall ASA and FTD software. A crafted connection request, with no login needed, can make the firewall reboot, knocking everyone offline. It affects devices that use secondary authentication on a VPN tunnel group.

A firewall is the front door of your office network. If an attacker owns it, they can watch traffic, steal the VPN and Active Directory passwords stored on it, and move into everything behind it.

What to do this week

  1. Take the firewall's admin page off the internet. Management should only be reachable from inside the office network or through a secured jump connection with multifactor authentication, never from the open web.
  2. Install the latest firmware. Ask your firewall, VPN and NAS vendors whether they are affected by PHP2Shell or Fragnesia and apply their fixed release. On Linux servers you manage, install your distribution's kernel update for CVE-2026-46300.
  3. Running a Cisco ASA or FTD with SSL VPN? Update to Cisco's fixed release for your version, or follow Cisco's temporary mitigation for secondary authentication until you can.
  4. Check before you patch. Look for unfamiliar admin accounts, odd files in web folders, new startup services, or the firewall connecting out to addresses you don't recognize. If anything looks wrong, rebuild the device from a clean image instead of just patching it.
  5. Reset the passwords stored on any exposed firewall, including admin logins, VPN accounts and the Active Directory service account it uses.

Nice2GeekYou is based in San Antonio, serving all of Texas on site, and our managed IT plans cover remote clients across the U.S. We keep firewalls patched, their admin pages locked away from the internet, and VPN access tied to multifactor authentication. Request a quote, see our monthly plans, or text us at (210) 504-8969.

Sources: CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct 28, 2026); Red Tiger Security — PHP2Shell Plus Fragnesia: CISA Confirms Firewall Takeover Chain (Oct 28, 2026); BleepingComputer — InfraTrust report warns of exploited flaws in critical network infrastructure (Oct 28, 2026); The Hacker News — Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls (Oct 29, 2026).