Attackers exploit PHP2Shell flaws in Palo Alto Networks management interfaces exposed on the Internet

Palo Alto Networks warned Wednesday that malicious actors are exploiting recently patched PHP2Shell vulnerabilities against publicly available management interfaces.

“Active exploitation has been observed targeting Palo Alto Networks’ management interface exposed to the Internet,” the network security company said in an update to its advisory.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), allow attackers to execute unauthenticated remote code on systems running affected versions of PHP. The issues were fixed upstream by the PHP Foundation on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The development comes days after Israeli cybersecurity firm Dream said it observed a suspected China-linked threat actor using the flaws in conjunction with a local privilege escalation bug in the Linux kernel, tracked as Fragnesia (CVE-2026-46300, CVSS score: 7.8), to root 25 servers in the United States, Japan, Taiwan and South Korea.

Among these were three systems belonging to an environment affiliated with the US government.

“The affected devices are running specific versions of a major vendor’s firewall software,” Dream noted. “The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration.”

Although Dream did not disclose the name of the affected firewall vendor, the timing of the advisory, combined with the fact that other network security companies have not reported malicious exploitation of their products, suggests that these events may be related.

This development prompted the US Cybersecurity and Infrastructure Security Agency (CISA) to add CVE-2026-46300 to its catalog of known exploited vulnerabilities (KEV), requiring federal agencies to apply the patches by October 31, 2026.

“This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP web shells and execute commands as root,” CISA said.

Palo Alto Networks also noted that no special configuration is required to be affected by this issue, adding that the risk is higher on PAN-OS when access to the management interface is allowed from external IP addresses on the Internet.

“This issue strictly affects the management web interface, which includes the HTTPS web UI and the XML API service,” it says. “This affects the data plane interface only if a management profile is attached to it.”

The following versions of PAN-OS are impacted by PHP2Shell –

• PAN-OS 12.2

  • < 12.2.4-h1 (Fixed in >= 12.2.4-h1)

• PAN-OS 12.1

  • < 12.1.4-h13 (Fixed in >= 12.1.4-h13) (ETA: 10/29)
  • < 12.1.7-h11 (Fixed in >= 12.1.7-h11)
  • < 12.1.10-h3 (Fixed in >= 12.1.10-h3) (ETA: 10/30)

• PAN-OS 11.2

  • < 11.2.4-h23 (Fixed in >= 11.2.4-h23) (ETA: 10/30)
  • < 11.2.7-h23 (Fixed in >= 11.2.7-h23)
  • < 11.2.10-h16 (Fixed in >= 11.2.10-h16)
  • < 11.2.13-h4 (Fixed in >= 11.2.13-h4)
  • < 11.2.16-h1 (Fixed in >= 11.2.16-h1)

• PAN-OS 11.1

  • < 11.1.4-h38 (Fixed in >= 11.1.4-h38)
  • < 11.1.6-h40 (Fixed in >= 11.1.6-h40)
  • < 11.1.7-h12 (Fixed in >= 11.1.7-h12) (ETA: 10/30)
  • < 11.1.10-h36 (Fixed in >= 11.1.10-h36)
  • < 11.1.13-h16 (Fixed in >= 11.1.13-h16)
  • < 11.1.16-h4 (Fixed in >= 11.1.16-h4)

• PAN-OS 10.2

  • < 10.2.7-h39 (Fixed in >= 10.2.7-h39) (ETA: 10/30)
  • < 10.2.10-h42 (Fixed in >= 10.2.10-h42) (ETA: 29/10)
  • < 10.2.13-h27 (Fixed in >= 10.2.13-h27)
  • < 10.2.16-h12 (Fixed in >= 10.2.16-h12)
  • < 10.2.18-h13 (Fixed in >= 10.2.18-h13)

For PAN-OS releases for which patch releases are not yet available, Palo Alto Networks has recommended the following mitigation measures:

• Route inbound traffic for the MGT port through a DP port, for example by enabling the management profile on a DP interface for management access.
• Replace the certificate for handling inbound traffic.
• Decrypt incoming traffic to the management interface so the firewall can inspect it.
• Enable threat prevention on inbound traffic to management services.

“Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 and later received early coverage, released via threat ID 543004, which was released at 10:21 p.m. PT on October 20,” the release said.

“The security risk posed by this issue on PAN-OS and Panorama is minimized by limiting access to the management interface to only trusted internal IP addresses, in accordance with our recommended deployment best practices.”

Palo Alto Networks Confirms Dream Report

“We are aware of Dream’s report describing unauthorized exploitation activity targeting Internet-facing PAN-OS management interfaces,” a Palo Alto Networks spokesperson told The Hacker News.

“Customers who have applied available patches are not affected. Additionally, customers who follow our standard recommendation of not exposing the management interface to the public Internet are also not affected.”

In an updated threat briefing, Palo Alto Networks recommends that customers follow the steps below:

• Immediately remove public Internet access to management interfaces if enabled.
• Restrict access to trusted internal IP addresses.
• Apply available PAN-OS patches for PHP2Shell.

“Based on data from our Xpanse attack surface management product, only a small fraction of one percent (less than 0.01%) of our global installed base has Internet management interfaces configured, and each of these potentially affected customers has been contacted individually by our teams,” the spokesperson added. “We will continue to investigate and provide any necessary updates as they become available.”

In an update, Dream confirmed that it was “sharing updates and collaborating on an investigation with Palo Alto Networks,” adding that the attacker “invested significant effort in researching vulnerabilities – obtaining PAN-OS firmware, decrypting it, extracting PHP libraries, creating precise memory profiles for 9 different software versions, and calibrating exploit geometry via lab testing.”

As of October 30, 2026, patches have been released for all vulnerable versions of PAN-OS 12.2, PAN-OS 12.1, PAN-OS 11.2, PAN-OS 11.1, and PAN-OS 10.2. “The GlobalProtect portal, gateway and clientless VPN are not affected,” Palo Alto Networks said.

(The story was updated after publication to include a response from Palo Alto Networks.)