Active PHP2Shell Attacks Target Palo Alto PAN-OS Management Access

Palo Alto Networks has warned that threat actors are actively exploiting the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, against management interfaces exposed to the internet. Both flaws carry a CVSS score of 9.2 and can enable unauthenticated remote code execution on systems running affected PHP versions.

The company said the most significant risk is to PAN-OS deployments that allow access to the management interface from external internet IP addresses. The affected management surface comprises the HTTPS web UI and XML API service. A dataplane interface is in scope only when a management profile is attached to it.

Attack activity raises urgency for exposed management services

The PHP Foundation released upstream fixes on October 21, 2026, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Palo Alto Networks’ notice follows observations by Israeli cybersecurity company Dream of suspected China-nexus activity that combined PHP2Shell with Fragnesia, a Linux kernel local privilege-escalation issue tracked as CVE-2026-46300 and rated CVSS 7.8.

Dream said the campaign rooted 25 servers in the United States, Japan, Taiwan and South Korea, including three systems in a U.S. government-affiliated environment. It reported attacks against Active Directory, with recovered artifacts indicating credential extraction and directory enumeration. The operational impact of rapid PHP2Shell exploitation is also illustrated by PHP2Shell breach of a European government body, where password hashes were obtained within two hours.

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog and directed federal agencies to apply fixes by October 31, 2026. CISA warned that attackers can chain the kernel flaw with CVE-2026-109618 and CVE-2026-109619 to implant PHP web shells and execute commands as root.

Impacted PAN-OS releases and available protections

Palo Alto Networks lists affected releases across PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2. Fixed builds include PAN-OS 12.2.4-h1, 12.1.4-h13, 11.2.4-h23, 11.1.4-h38 and 10.2.7-h39, alongside later maintenance builds for the relevant release trains. Some fixes were listed with October 29 or October 30 availability dates.

For versions without an available corrected build, the vendor recommends routing incoming MGT-port traffic through a dataplane port, enabling a management profile on that dataplane interface for management access, replacing the certificate for inbound traffic management, decrypting inbound management traffic for inspection, and enabling threat prevention on inbound management services.

Customers using Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 and later received advance coverage through Threat ID 543004, released at 10:21 PM PT on October 20. Palo Alto Networks also states that restricting management access to trusted internal IP addresses materially reduces the security risk. For businesses, the immediate implication is to inventory externally reachable management services, limit access to trusted networks, apply the relevant PAN-OS update, and retain mitigations where a fixed build is not yet available.