Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCcriticalExploited in the wild

Attackers chain PHP2Shell flaws to root Palo Alto PAN-OS firewalls

Original title: Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls

GBHackersby Eswar ()3 min read1
Read at gbhackers.com
Part of a story covered by 21 sourcesPHP2Shell chain roots exposed Palo Alto PAN-OS systemsMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Hunt.io says 24 perimeter firewalls and one internal management server were compromised, including a US government-affiliated environment.

Attackers chained PHP2Shell memory-safety bugs CVE-2026-109618 and CVE-2026-109619 with the Fragnesia kernel flaw CVE-2026-46300 to gain root on Palo Alto Networks PAN-OS. Hunt.io, citing Dream Research, says a custom appweb exploit moved from honeypots to production and compromised 25 systems after filtering about 19,000 exposed firewalls down to 240 targets. A reverse SSH tunnel reached a US government-affiliated environment and exposed management configurations and directory-service credentials. Standalone PHP fixes are 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

Unconfirmed: Hunt.io's compromise counts are investigative findings, and exposed exploit files do not prove a given target was compromised.

Key facts
  • PHP2Shell is rated CVSS 4.0 9.2 and abuses session.upload_progress handling.
  • Targeted management servers used a uniform PHP 8.0.30 build.
  • Fingerprinting found about 5,000 responsive devices before 240 were selected.
  • Disabling session.upload_progress.enabled is a temporary mitigation.
  • Hunt.io also found panos_rce_poc.py and prce.py on an exposed host.
Security assessment · AI, from the articleExploited in the wild

Impact: Root on PAN-OS plus management and directory credentials

ProductAffectedFixed in
Palo Alto Networks PAN-OS——
PHP—8.2.35, 8.3.36, 8.4.27, or 8.5.12
What to do
  1. 1.Apply vendor-supported PAN-OS remediation and restrict management-interface exposure.
  2. 2.Upgrade standalone PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12.
  3. 3.If patching must wait, disable session.upload_progress.enabled.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-109618CVE-2026-109619CVE-2026-46300
ATT&CK
T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1572 Protocol Tunneling
Tags
pan-osphpphp2shellprivilege-escalationfirewall
Vendors
Palo Alto Networks
Products
PAN-OSPHP
Organizations
Hunt.ioDream Research
Countries
United States

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV
CVE-2026-46300
Shared-frag marker loss in Linux kernel skb coalescing (LPE)
7.816%KEVPoC
KEV

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
ipv4101.133.233.1590[.]81 AS149440 Evoxt JP Shared 9bie kit (variant), lab RCE 101.133.233[.]159 AS37963 Alibaba Cloud CN Shared 9bie kit plus scanner 144
ipv4130.12.180.89.27.25[.]75 AS149440 Evoxt DE Staging; education/commercial 130.12.180[.]89 AS202412 Omegatech DE php2shell attempted, failed; pivote
ipv4130.94.67.235S211273 Cloud Software FZCO HK Dev/build box, Moodle victim 130.94.67[.]235:80,8080 AS154177 Light Node Limited JP PAN-OS repackage 4
ipv4144.217.161.236.]159 AS37963 Alibaba Cloud CN Shared 9bie kit plus scanner 144.217.161[.]236 AS16276 OVH CA Staging; govt finance targets 152.42.245[.
ipv415.204.59.7094 AS19318 Interserver US Confirmed source, honeypot shells 15.204.59[.]70 AS16276 OVH US Confirmed source, honeypot shells 2.59.133
ipv4152.42.245.8.217.161[.]236 AS16276 OVH CA Staging; govt finance targets 152.42.245[.]8 AS14061 DigitalOcean SG Staging; commercial targets 23.27
ipv4162.35.99.94movement. IOCs IP / host ASN Hosting provider Country Role 162.35.99[.]94 AS19318 Interserver US Confirmed source, honeypot shells
ipv4185.242.106.14045[.]102:8088 AS46475 Limestone Networks US Staging cluster 185.242.106[.]140:8000 AS42532 SIA VEESP LV Operational toolkit 45.39.190[.
ipv4208.115.245.102245[.]99:8088 AS46475 Limestone Networks US Staging cluster 208.115.245[.]102:8088 AS46475 Limestone Networks US Staging cluster 185.24
ipv4208.115.245.98]151 AS58212 dataforest GmbH DE Confirmed source, GreyNoise 208.115.245[.]98:8088 AS46475 Limestone Networks US Staging cluster 208.11
ipv4208.115.245.99245[.]98:8088 AS46475 Limestone Networks US Staging cluster 208.115.245[.]99:8088 AS46475 Limestone Networks US Staging cluster 208.11
ipv423.27.25.75245[.]8 AS14061 DigitalOcean SG Staging; commercial targets 23.27.25[.]75 AS149440 Evoxt DE Staging; education/commercial 130.12.18
ipv42.59.133.15104.59[.]70 AS16276 OVH US Confirmed source, honeypot shells 2.59.133[.]151 AS58212 dataforest GmbH DE Confirmed source, GreyNoise 20
ipv434.146.20.31Host SRL MD Exploit-development host; lab info-leak working 34.146.20[.]31 AS396982 Google LLC JP Shared 9bie kit, lab RCE 38.60.136
ipv438.60.136.217146.20[.]31 AS396982 Google LLC JP Shared 9bie kit, lab RCE 38.60.136[.]217 AS154177 Light Node Limited FR Shared 9bie kit, lab RCE 9
ipv445.225.135.53gatech DE php2shell attempted, failed; pivoted to other bug 45.225.135[.]53 AS64107 RACK SPHERE NL SMTP/XXE operator; php2shell scann
ipv445.39.190.176242.106[.]140:8000 AS42532 SIA VEESP LV Operational toolkit 45.39.190[.]176:8000 AS211273 Cloud Software FZCO HK Dev/build box, Moodl
ipv445.83.180.113235:80,8080 AS154177 Light Node Limited JP PAN-OS repackage 45.83.180[.]113:19001 AS62005 BlueVPS EE IoC/kit tracker 15.204.59[.]70:8
ipv485.121.179.1294:8090 AS19318 Interserver US Metabase/H2, separate exploit 85.121.179[.]129 AS48753 AlexHost SRL MD Exploit-development host; lab inf
ipv496.126.130.81217 AS154177 Light Node Limited FR Shared 9bie kit, lab RCE 96.126.130[.]81 AS149440 Evoxt JP Shared 9bie kit (variant), lab RCE 101.

From the original article

3 min read at gbhackers.com

Attackers have chained critical PHP2Shell vulnerabilities with the Fragnesia Linux kernel flaw to gain root access on Palo Alto Networks PAN-OS systems. The campaign reportedly compromised 24 internet-facing firewalls before reaching an internal firewall management server, bringing the total to 25 compromised systems. Hunt.

GBHackers

By Eswar · gbhackers.com

Read the full article at GBHackers

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.