PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
Original title: PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
Threat actors have probed PHP2Shell for over a week, with few confirmed compromises. Dream and Unit 42 say attackers chained CVE-2026-109618 and CVE-2026-109619 on internet-exposed PAN-OS management interfaces with the Fragnesia kernel bug. Palo Alto patched PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 for PA-Series, VM-Series and Panorama, and says about 0.02% of its installed base was exposed and contacted. Telemetry found over 22.6 million potentially vulnerable PHP instances. Defiant knew of no WordPress compromise as of October 28 despite more than 77,000 related requests.
Unconfirmed: Broad scanning is widespread, but confirmed successful compromises beyond the PAN-OS campaign remain few and partly limited to proof commands.
- Dream said at least 25 firewalls in a pool of hundreds were hacked.
- Cato says about 96% of blocked attacks targeted CVE-2026-109618 and 41% tried RCE.
- Cato saw attempts from a handful of IPs in the US, the Netherlands and Germany.
- WatchTowr saw successful exploitation from one German IP that only ran curl.
- Healthcare was the most targeted sector in Cato’s opportunistic scanning.
Impact: Root access and webshells on exposed firewall management interfaces
| Product | Affected | Fixed in |
|---|---|---|
| Palo Alto Networks PAN-OS | PA-Series and VM-Series; no special configuration required | 12.2, 12.1, 11.2, 11.1, and 10.2 |
| Palo Alto Networks Panorama | virtual and M-Series | 12.2, 12.1, 11.2, 11.1, and 10.2 |
- 1.Restrict access to internet-exposed PAN-OS management interfaces and apply the PAN-OS fixes.
- 2.Update PHP; Defiant says exploits may need per-server adjustment but patching remains essential.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web Shell
- Vendors
- Palo Alto Networks
- Organizations
- DreamUnit 42DefiantCato NetworksWatchTowr
- Countries
- China
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
3 min read at securityweek.com
Over 22. 6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week. The post PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.