PHP2Shell flaws exploited on exposed Palo Alto management interfaces
Original title: Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
Unauthenticated RCE hits internet-facing PAN-OS management; CISA set an October 31 deadline for kernel bug CVE-2026-46300.
Palo Alto Networks says attackers are exploiting PHP2Shell, CVE-2026-109618 and CVE-2026-109619, against management interfaces exposed to the internet. The bugs allow unauthenticated remote code execution and affect listed PAN-OS 10.2 through 12.2 branches, with several hotfixes still pending. No special configuration is required; risk is highest when external addresses can reach the management web UI or XML API. CISA added Linux kernel flaw CVE-2026-46300 to KEV, saying it can be chained to run commands as root.
Unconfirmed: Dream did not name the firewall vendor, so a link to these PAN-OS attacks is not confirmed.
- PHP fixes landed October 21 in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- PAN-OS 12.2 is fixed in 12.2.4-h1 and later.
- Dream reports 25 servers rooted in the U.S., Japan, Taiwan, and South Korea.
- Three of those belonged to a U.S. government-affiliated environment, Dream said.
- Frontier Virtual Patching coverage used Threat ID 543004 from October 20.
Impact: Unauthenticated remote code execution on the management interface
| Product | Affected | Fixed in |
|---|---|---|
| Palo Alto Networks PAN-OS | 12.2 before 12.2.4-h1; listed 12.1, 11.2, 11.1, and 10.2 builds below the stated hotfixes | 12.2.4-h1 and the branch hotfixes named in the advisory |
| PHP Foundation PHP | — | 8.5.12, 8.4.27, 8.3.36, and 8.2.35 |
- 1.Install the fixed PAN-OS hotfix for each affected branch.
- 2.Allow management access only from trusted internal addresses.
- 3.Until fixes ship, move management onto a dataplane interface and inspect inbound traffic.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web Shell
- Countries
- United StatesJapanTaiwanSouth Korea
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
3 min read at thehackernews.com
Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet," the network security company said in an update to its advisory. The vulnerabilities, tracked as
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.