Palo Alto confirms PHP2Shell attacks gaining root access

Palo Alto Networks has confirmed that attackers chained two PHP2Shell vulnerabilities with a Linux kernel flaw to gain root access—the highest level of control—on its firewalls. In its October 30 report, SecurityWeek said Dream researchers identified at least 25 compromised firewalls among hundreds examined, making internet-exposed management interfaces an immediate priority for administrators.

Palo Alto Networks says active exploitation targets management interfaces exposed to the internet, although no special configuration is required for the vulnerabilities to affect a device. Those interfaces are not internet-facing by default. The company said approximately 0.02% of its global installed base had internet-facing management interfaces configured and was impacted; its teams have individually contacted those customers.

The affected products include PA-Series and VM-Series firewalls and Panorama management systems, both virtual and M-Series, running vulnerable PAN-OS releases. Fixes are available across the 12.2, 12.1, 11.2, 11.1 and 10.2 release trains.

Confirmed firewall compromises amid widespread attempts

SecurityWeek described the firewall attackers as a China-linked group and reported that they used AI assistance to develop the exploit chain. The chain combines PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, with Fragnesia, a Linux kernel privilege-escalation vulnerability that lets an attacker increase their access. The attackers deployed webshells, server-side programs that provide remote command access, with root privileges.

Palo Alto Networks said its Unit 42 researchers independently verified the same attacker’s tooling and confirmed Dream’s reported results.

The broader attack activity has run for more than a week, SecurityWeek reported, but confirmed successes remain limited. Palo Alto Networks said its telemetry had identified more than 22.6 million exposed PHP instances potentially vulnerable to PHP2Shell as of October 29. That is a count of instances, not compromised systems.

PHP powers many web applications, including WordPress, Drupal and Joomla. Defiant, the web security company behind Wordfence, had recorded more than 77,000 related requests from over 2,000 IP addresses by October 28, while remaining unaware of any WordPress site successfully compromised through PHP2Shell.

Defiant’s testing found that exploits often require adjustments for the target server. Results depend on address space layout randomization, which varies memory locations, as well as the PHP build, installed extensions, memory limits and how the server handles requests. Successful exploitation could expose site files, databases and passwords, the company warned.

How PHP2Shell reaches code execution

Palo Alto Networks’ advisory, published October 21 and updated October 29, describes two failures in PHP’s handling of request memory.

CVE-2026-109618 involves out-of-memory errors handled through longjmp(), a mechanism that abruptly transfers execution out of the current context. Improper handling can leave request memory uninitialized; later cleanup can read that memory or use it to decide what code runs. Attackers can trigger these conditions to achieve remote code execution, meaning they can run code on the server.

CVE-2026-109619 involves global state retaining references to request memory after that memory has been freed. Subsequent requests can read or act on those stale references, also enabling code execution. NVD assigns the vulnerabilities CVSS severity scores of 9.8 and 8.1, respectively; Palo Alto Networks rates the product impact critical at 9.2 under CVSS 4.0.

CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26, with an October 29 remediation deadline for US federal civilian agencies. Its required action includes vendor-directed mitigation, compliance with its BOD 26-04 patching and forensic-triage guidance, assessment of internet exposure, and discontinuing use if mitigations are unavailable.

Cato Networks reported that roughly 96% of the attacks it blocked targeted CVE-2026-109618, while 41% attempted remote code execution; the remainder involved scanning or invalid proof-of-concept attempts. Requests came from a handful of IP addresses in the United States, the Netherlands and Germany. Command execution dominated, followed by deserialization attempts, which target how software reconstructs stored or transmitted data.

Healthcare organizations received the most attempts in Cato’s observations, followed by technology and security services, professional services, automotive, education and nonprofit organizations, then manufacturing, construction and retail. Cato characterized the activity as opportunistic: the same source sent requests to organizations in different sectors on the same day.

WatchTowr observed successful exploitation from one German IP address. In each observed case, the attacker ran a simple curl command to demonstrate success and stopped, with no additional activity afterward. Its threat intelligence head, Jake Knott, said attackers were developing new payloads and more reliable appliance-specific exploits.

Updates and management-interface protections

Administrators should immediately restrict management-interface access to trusted internal IP addresses and install the appropriate fixes, Palo Alto Networks recommends. Its advisory lists these fixed releases within each PAN-OS train; administrators should select the hotfix corresponding to their maintenance branch or a later fixed release:

These hotfixes address both PHP flaws. They also fix the brotli compression-library vulnerability used by Node.js, except for 11.2.10-h16, which fixes only PHP; 11.2.10-h17 covers both.

The advisory lists Bridgecrew, Cloud NGFW, Cortex Cloud, Cortex XCORE SaaS, Cortex XDR Agent, Cortex XDR Broker VM, Cortex XSIAM, Cortex XSOAR and Cortex Xpanse as unaffected. Separately, the vendor’s current analysis finds no impact from the newer PHP vulnerability CVE-2026-115560 on PAN-OS firewalls or Panorama because they do not use the relevant uncommon configuration; other products remain under review.

For subscribed customers, Frontier Virtual Patching through ATP Plus provided advance coverage on PAN-OS 12.2.4 and later through Threat ID 543004, released October 20 at 10:21 p.m. PT. Threat Prevention coverage is available through Applications and Threats content versions 9162, 9163, 9164 and later, using Threat IDs 543004, 97622, 97623, 97624, 97625, 97643, 97647, 97649, 97652, 97653, 97656, 97657, 97658, 97659, 97662, 97663, 97664, 97670, 97671, 97672, 97673, 97674, 97676, 97677 and 97678.

That protection requires configuration: route incoming management-port traffic through a data-plane port, replace the certificate for inbound traffic management, decrypt inbound management traffic for inspection and enable threat prevention on it. Palo Alto Networks urges customers to restrict management access immediately and apply the fixes. For WordPress and other PHP-based sites, Defiant’s practical recommendation is to update PHP as attackers continue adapting their tools.