FHN 
Palo Alto Networks has confirmed that hackers are actively exploiting PHP2Shell vulnerabilities to attack PAN-OS management interfaces that are accessible from the internet.
In an October 29, 2026 update, the company’s Unit 42 team confirmed that attackers were combining two PHP vulnerabilities with a Linux kernel flaw to gain full system access.
The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, have critical CVSS scores of 9.2 each. They could allow attackers to run malicious code remotely without logging in.
Palo Alto said around 0.02% of its global customer base had internet-facing management interfaces affected by this issue. The company has contacted those customers directly.
This is a significant development because the vendor had not previously confirmed active attacks against its products using these PHP flaws.
How PHP2Shell Attacks Work
The two vulnerabilities are related to how PHP handles memory when a request fails.
- CVE-2026-109618: Improper memory handling during an error can leave data in an unsafe state, giving attackers an opportunity to execute malicious code.
- CVE-2026-109619: PHP may continue using memory that has already been released. Attackers can take advantage of this condition to run their own commands.
These issues affect several PHP environments, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
The PHP Group has released fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Unit 42 also estimated that more than 22.6 million internet-facing PHP instances could be vulnerable. This number represents potential exposure, not confirmed compromises.
Researchers at Dream Research identified evidence of attacks involving 25 compromised PAN-OS firewall and management servers across the United States, Japan, Taiwan and South Korea. Three of the systems were associated with a US government-affiliated environment.
The attackers reportedly sent specially crafted requests to the PAN-OS management web server to exploit the PHP flaws. This allowed them to execute commands with limited privileges. They then used another Linux kernel vulnerability, known as Fragnesia (CVE-2026-46300), to escalate privileges and gain root access.
Investigators also found signs of webshell installation, internal network tunneling, LDAP credential theft and Active Directory discovery. However, they could not confirm whether all attempted follow-up attacks were successful.
PAN-OS Security Updates and Protection Steps
Palo Alto confirmed that the affected areas are the management HTTPS interface and XML API. PA-Series and VM-Series firewalls, along with Panorama, are included.
GlobalProtect portals, gateways, Clientless VPN and Captive Portal are not affected by these PHP vulnerabilities.
Organizations using PAN-OS should take the following steps immediately:
- Remove direct internet access to management interfaces.
- Restrict management access to trusted internal IP addresses.
- Install the appropriate PAN-OS security hotfix.
- Review firewall logs for unusual requests and suspicious activity.
- Check systems for unexpected webshells or unauthorized access.
Palo Alto has released fixes for multiple PAN-OS versions, including 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4 and 10.2.18-h13.
The key takeaway: Internet-facing firewall management interfaces can become a serious entry point for attackers. Restricting access and applying security updates quickly are essential to reducing the risk of compromise.
About the Author
