PHP2Shell Is Now Being Used Against Exposed Palo Alto Networks Firewalls

Palo Alto Networks has confirmed that the two critical PHP2Shell vulnerabilities are being exploited in the wild against PAN-OS management interfaces that are reachable from the internet. The flaws were fixed upstream only a week ago, and the window between patch and weaponisation has already closed.

What happened

The bugs are tracked as CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. They allow an unauthenticated attacker to run arbitrary code on any system that ships a vulnerable PHP build. The PHP project released corrected versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35) on 21 October 2026.

PAN-OS embeds PHP in its management web stack, and that is where the exploitation is landing. The vendor's updated advisory states that active attacks are hitting the HTTPS web UI and the XML API of firewalls and Panorama appliances whose management service is open to the internet. No special configuration is needed for a device to be affected. The data plane is only at risk if a management profile has been bound to a traffic interface.

In the days before the advisory, a suspected China-nexus intrusion set was observed chaining PHP2Shell with Fragnesia (CVE-2026-46300, CVSS 7.8), a local privilege-escalation bug in the Linux kernel. The combination gave the operators root on roughly 25 servers in the United States, Japan, Taiwan and South Korea, including three systems in a U.S. government-affiliated environment. The compromised hosts ran a major vendor's firewall software, and once inside, the attackers moved against Active Directory: recovered artefacts show credential extraction and directory enumeration.

The firewall vendor behind those intrusions has not been named, so a direct link to the Palo Alto Networks campaign remains unconfirmed. The timing, and the absence of similar reports from other network-security vendors, make the connection plausible.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-46300 to its Known Exploited Vulnerabilities catalogue and set a remediation deadline of 31 October 2026 for federal agencies. CISA notes that the kernel bug can be chained with the two PHP flaws to drop web shells and execute commands as root.

Why it matters

A firewall management plane is the keys to the kingdom. An attacker who gets root on the device can read and alter policy, harvest credentials, intercept VPN and admin sessions and pivot straight into the internal network. The Active Directory activity seen in the related intrusions shows that this is not a smash-and-grab: the operators are using the firewall as a beachhead.

The exposure condition is simple and common. Every PAN-OS deployment whose management interface answers to arbitrary external addresses is a candidate target, regardless of how the device is otherwise configured.

Affected PAN-OS versions

Fixed builds are shipping per release train; a few are still due over the next two days.

Any build older than the hotfix listed for its branch is vulnerable.

What to do

1. Find every PAN-OS and Panorama management interface that is reachable from the internet. This is the single condition that puts you in the line of fire. Lock management access down to trusted internal addresses, which the vendor itself describes as the primary risk reducer.
2. Patch to the fixed hotfix for your train as soon as it is available. Treat the 31 October CISA deadline as a sensible target even if you are not a federal agency.
3. If your fix is still pending, apply the interim mitigations: route management traffic through a data-plane port with a management profile, replace the inbound-management certificate, decrypt inbound traffic to the management interface so the firewall can inspect it, and enable threat prevention on that traffic. Customers running Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 or later have had signature coverage (Threat ID 543004) since 20 October.
4. Hunt for compromise, not just exposure. Review management-plane access logs for unexpected source IPs, look for unfamiliar PHP files in the web root, check for unexpected root processes, and audit Active Directory for unusual enumeration or credential-dumping activity originating from the firewall's address.
5. Patch PHP everywhere else. PHP2Shell is not specific to firewalls; any internet-facing PHP application on an older runtime carries the same unauthenticated RCE risk.

Exposed management interfaces are exactly the kind of finding that goes unnoticed until a vendor advisory forces the question. Our Attack Surface Management service continuously maps what your organisation exposes to the internet, flags administrative panels and appliance management ports the moment they appear, and tells you which ones are running a version with a known exploited vulnerability, so this week's question has an answer before the next advisory lands.