PHP2Shell Flaws Enable RCE on PHP and PAN-OS
October 30: Palo Alto confirms PHP2Shell exploitation on exposed PAN-OS interfaces and Unit 42 verifies kernel CVE-2026-46300 chaining for root on 25 servers including government-affiliated.
PHP2Shell RCE flaws exploited on PHP servers and PAN-OS; CISA KEV listed October 26 with fixes for PHP 8.2-8.5.
Two PHP engine flaws, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), allow unauthenticated remote code execution on vulnerable PHP installations dating to 5.4. PHP released fixes on October 21 for versions 8.2.35 through 8.5.12, while CISA added both to its Known Exploited Vulnerabilities catalog on October 26 with a federal mitigation deadline of October 29. Attackers have used public exploit code against honeypots, with successful RCE confirmed including memory dumps. New reports detail exploitation on internet-exposed Palo Alto PAN-OS management interfaces, with Unit 42 verifying chaining to Linux kernel flaw CVE-2026-46300 for root access on compromised servers. A separate CVE-2026-115560 remains unpatched.
- Discovered by Wiz August 2026 via AI review allowing RCE and secret leaks
- PHP fixes 8.2.35-8.5.12 released October 21
- CVSS 9.2 both; CISA KEV October 26, federal deadline October 29
- Exploited on Apache mod_php and PAN-OS 10.2-12.2 branches
- Separate CVE-2026-115560 unpatched requiring session.upload_progress=0
- Over 32M PHP services exposed per Censys estimates
Timeline
dated events in the reporting · oldest first- Aug 19, 2026Wiz discovers PHP2Shell memory corruption bugs with AI-assisted review · Cyber Security News
- Aug 20, 2026Same flaw works against Drupal and WordPress sites · Cyber Security News
- Oct 21, 2026PHP discloses flaws and releases fixes for 8.2.35-8.5.12 · The Hacker News
- Oct 24, 2026Perplexity reports successful RCE on honeypots with cookie dump · BleepingComputer
- Oct 26, 2026CISA adds both to KEV; OffSec releases free lab and PoC · The Hacker News
- Oct 30, 2026Palo Alto confirms targeting PAN-OS management interfaces and root chaining · Cyber Security News
What each outlet adds
beyond the shared facts- Palo Alto NetworksExploitation on internet-exposed PAN-OS interfaces and Unit 42 kernel CVE chaining for root
- OffSecFree Proving Grounds lab and Exploit-DB PoC release
- The Register35 successful shells logged on honeypots October 24 and 50,000 requests tracked
- Security Affairs216 unpatched hosts listed and Cyfirma scan data
- The Hacker NewsCISA KEV confirmation, Brotli decoder fixes in Windows builds, and 32.51M PHP services exposed
Coverage
oldest first · one row per article · UTC- · 7d ago
Infosecurity MagazineFirst report
PHP urges workaround for unpatched RCE CVE-2026-115560
The bug needs a rare runtime switch of the session serialize handler and will not be fixed until the next release.
- · 7d ago
BleepingComputer
PHP2Shell RCE flaws confirmed exploited against PHP 8.4.26
A Perplexity honeypot saw working RCE and an 800 KiB cookie dump on Apache mod_php; a separate unpatched RCE still needs a config workaround.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-115560 | — | — | PoC ×11 | — | |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |