Palo Alto confirms PHP2Shell attacks on exposed PAN-OS management
Original title: Palo Alto Confirms Active PHP2Shell Exploitation Targeting Exposed PAN-OS Management Interfaces
Unit 42 verified tools that pair the PHP flaws with kernel bug CVE-2026-46300 for root; about 0.02% of the installed base was exposed.
Palo Alto Networks said attackers are exploiting PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 against internet-exposed PAN-OS management interfaces. Each scores CVSS 9.2 and can yield unauthenticated remote code execution. Unit 42’s October 29 update says verified attacker tools then used Linux kernel flaw Fragnesia (CVE-2026-46300) to reach root. Dream Research reported artifacts on 25 firewall and management servers in the United States, Japan, Taiwan and South Korea, including three in a US government-affiliated environment.
Unconfirmed: Dream could not confirm later password spraying or backdoor-account attempts succeeded; an earlier October 23 Unit 42 link to a European agency was retracted.
- Dream counted 25 compromised PAN-OS systems, three of them US government-affiliated.
- Attackers ran commands as the nobody user, then used CVE-2026-46300 for root.
- Hotfixes include 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4 and 10.2.18-h13.
- GlobalProtect, Clientless VPN and Captive Portal are not affected.
- Unit 42 counted over 22.6 million potentially exposed PHP instances worldwide, not confirmed firewall breaches.
Impact: Unauthenticated RCE, then root, on exposed PAN-OS management
| Product | Affected | Fixed in |
|---|---|---|
| Palo Alto Networks PAN-OS (PA-Series, VM-Series, Panorama) | management HTTPS interface and XML API; dataplane only if a management profile is attached | 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4, 10.2.18-h13, plus other maintenance releases |
| PHP Group PHP | PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed deployments | 8.2.35, 8.3.36, 8.4.27, 8.5.12 |
- 1.Remove public management access and allow only trusted internal IP addresses.
- 2.Install the matching PAN-OS hotfix, which Palo Alto says interrupts the observed chain.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web Shell
- Vendors
- Palo Alto NetworksPHP Group
- Organizations
- Unit 42Dream Research
- Countries
- United StatesJapanTaiwanSouth Korea
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
3 min read at cybersecuritynews.com
Palo Alto Networks has confirmed that attackers are actively exploiting PHP2Shell vulnerabilities against PAN-OS management interfaces exposed to the internet. In its October 29, 2026, update, Unit 42 said it independently verified attacker tools used to combine the PHP flaws with a Linux kernel vulnerability and gain root access. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.