Palo Alto Confirms Active PHP2Shell Exploitation Targeting Exposed PAN-OS Management Interfaces

Palo Alto Networks has confirmed that attackers are actively exploiting PHP2Shell vulnerabilities against PAN-OS management interfaces exposed to the internet. In its October 29, 2026, update, Unit 42 said it independently verified attacker tools used to combine the PHP flaws with a Linux kernel vulnerability and gain root access.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a critical CVSS 4.0 score of 9.2. They can allow remote code execution without a login. Palo Alto said roughly 0.02% of its global installed base had public management interfaces configured and was impacted. Its teams have contacted those customers individually, according to the Unit 42 threat brief.

The confirmation updates the earlier picture covered in Cyber Security News’ report on PHP vulnerabilities affecting PAN-OS, when the vendor had not reported malicious exploitation against its products.

PHP2Shell Enables Remote Code Execution

Both flaws involve unsafe memory handling when PHP stops processing a request after an error. CVE-2026-109618 affects out-of-memory handling through longjmp(), a function that jumps out of the current operation. That sudden exit can leave request data partly initialized. Cleanup routines may then read or act on that invalid data, creating a path to code execution.

CVE-2026-109619 leaves shared internal state pointing to memory that PHP has already freed. A later request handled by the same worker can reach those stale references before normal setup resets them. Attackers can use this condition to make the process execute their code.

The PHP Group’s security advisory identifies PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed deployments as exposed. Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Unit 42 counted more than 22.6 million exposed instances potentially vulnerable worldwide. That figure describes possible PHP exposure, not confirmed breaches or affected Palo Alto firewalls.

Dream Research reported finding campaign artifacts showing 25 compromised PAN-OS firewall and management servers across the United States, Japan, Taiwan, and South Korea. The count included three systems in a US government-affiliated environment.

The attacker used a custom PHP2Shell implementation aimed at the PAN-OS management web server. Crafted upload requests created memory pressure, leaked an address, and manipulated memory structures to execute commands as the restricted nobody user. A separate Linux kernel flaw, Fragnesia, tracked as CVE-2026-46300, then enabled root access.

Cyber Security News’ report on the 25-server campaign explains the wider impact. Dream found evidence of webshell placement, internal tunneling, LDAP credential extraction, and Active Directory enumeration. However, it could not confirm whether later password spraying or attempts to create backdoor accounts succeeded.

This confirmation should not be confused with Unit 42’s retracted October 23 update. That earlier account linked activity at a European government agency to PHP2Shell, but investigators could not establish that these specific flaws provided initial access. The October 29 update separately confirms the PAN-OS campaign.

PAN-OS Patches and Immediate Protection

Palo Alto’s security advisory limits the affected surface to the management HTTPS interface and XML API. PA-Series and VM-Series firewalls and Panorama are covered. GlobalProtect portals, gateways, Clientless VPN and Captive Portal are not affected by these PHP flaws. A dataplane interface is exposed only when a management profile is attached.

Administrators should immediately remove public management access, allow only trusted internal IP addresses, and install the correct PAN-OS hotfix. Fixed options include 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4 and 10.2.18-h13, with additional fixes for other maintenance releases. Palo Alto says these updates address both PHP vulnerabilities and interrupt the observed chain.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Palo Alto Confirms Active PHP2Shell Exploitation Targeting Exposed PAN-OS Management Interfaces appeared first on Cyber Security News.