Palo Alto Networks confirms active PHP2Shell exploitation of management interfaces

Palo Alto Networks confirmed that attackers are actively exploiting CVE-2026-109618 and CVE-2026-109619 against management interfaces exposed to the internet, the company said in an advisory dated Oct. 21.

“Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet,” Palo Alto Networks said. The flaws are critical PHP vulnerabilities that permit unauthenticated remote code execution, and no special setup is needed for PAN-OS to be affected. The issue hits the management web interface, covering the HTTPS web UI and XML API service, and it reaches dataplane interfaces only when a management profile is applied to them.

GlobalProtect portal, gateway, and Clientless VPN are not affected, and neither is Captive Portal. Palo Alto also listed 21 products as unaffected, including Cloud NGFW, Prisma Access, GlobalProtect App, Cortex XDR Agent, Cortex XSIAM, Cortex XSOAR, Cortex Xpanse, Prisma Cloud, and Strata Cloud Manager. PAN-OS 12.2 versions below 12.2.4-h1 are affected, with the fix available in 12.2.4-h1 and later.

Older branches are also exposed. PAN-OS 12.1 versions below certain hotfix levels are affected, with estimated fixes due Oct. 29 or Oct. 30 depending on the branch. PAN-OS 11.2 and 11.1 branches span multiple releases below listed hotfix levels, while PAN-OS 10.2 branches run from 10.2.7 through 10.2.18 below various hotfix levels.

Palo Alto has already issued fixed releases, including 10.2.18-h13, 11.1.16-h4, and 11.2.10-h16. The vendor released three more hotfixes on Oct. 28 after four on Oct. 27.

Palo Alto’s advisory rates the issue critical with the highest suggested urgency and CVSS-B 9.2. Help Net Security characterized the rating as high with CVSS-B 8.7 and moderate urgency and reported Oct. 22 that Palo Alto lacked awareness of malicious exploitation against its products. Fortinet’s PSIRT rates CVE-2026-109618 as critical at CVSS v3 9.8 and lists it as not known to be exploited, while FortiGuard Labs rates both CVEs at 9.2 under CVSS 4.0. The Hacker News and Palo Alto Networks also cite 9.2, contradicting Fortinet’s PSIRT.

Exploitation has reached real networks. CISA placed CVE-2026-46300, known as Fragnesia and scored at 7.8, on its Known Exploited Vulnerabilities catalog and told federal agencies to apply fixes by Oct. 31. CISA said the Linux kernel flaw can be combined with the two PHP vulnerabilities to deploy PHP web shells and execute commands with root privileges.

An Israeli cybersecurity company, Dream, observed a suspected China-nexus threat actor using the PHP2Shell flaws with Fragnesia to compromise 25 servers across the United States, Japan, Taiwan, and South Korea. Three of the compromised servers belonged to a U.S. government-affiliated environment. According to Dream, the attacker moved against Active Directory, and recovered artifacts showed credential extraction and directory enumeration. The compromised devices use specific versions of a major firewall vendor’s software, though Dream did not name the vendor.

Palo Alto advises organizations to keep management interfaces reachable only by trusted internal IP addresses. Palo Alto issued Threat ID 543004 at 10:21 PM PT on Oct. 20, giving customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 and later advance coverage.

For Threat Prevention subscribers, 25 threat IDs are available, including 543004 and 97622 through 97625, with content version 9162 or newer required. The conditions require management traffic to route through a dataplane port, replacement of the inbound management certificate, decryption of inbound management traffic, and threat prevention enabled on it.

The PHP Foundation issued patches Oct. 21. The covered PHP versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Palo Alto patched Cortex XCORE (SaaS) on Oct. 21 and WildFire Cloud on Oct. 22.

Other vendors are still sorting out exposure. Fortinet is investigating four products—FortiDDoS, FortiClient Cloud Services, FortiSOAR, and FortiSOAR PaaS—and says 43 entries are not affected, with FortiOS among them. Cisco says Cisco Ultra-Reliable Wireless Backhaul, Cisco Expressway Series and Expressway Select Series, and Duo Access Gateway are vulnerable, and it is investigating 10 products and one cloud service. Cisco PSIRT has not identified any confirmed cases of malicious exploitation.

Network appliances often build PHP into their management interfaces, and customers usually cannot apply PHP security updates on their own because vendors compile PHP into firmware, leaving them to wait for vendor firmware. InfraTrust recommends keeping PHP-backed management interfaces off the internet while waiting for patches.

Independent researchers reverse-engineered the flaws. VulnCheck says it rebuilt both PHP2Shell vulnerabilities late Oct. 20 after details of the flaws leaked ahead of the planned disclosure. It assesses that remote code execution is possible on ARM64 and on x86 systems that do not have address space layout randomization.

VulnCheck says just a handful of public proof-of-concept repositories correctly carry out the exploit mechanism, and none of those defeat ASLR on x86-64 alone, though ARM64 ASLR can be brute-forced relatively easily. It predicts that threat actors will broadly attempt exploits built from publicly available proofs of concept, no matter how effective those proofs are.

Searchlight Cyber put out php2shell-scanner, an open-source tool, on Oct. 22 to check whether a host is exposed to CVE-2026-109618 and CVE-2026-109619.

The remaining PAN-OS hotfixes are targeted for Oct. 29 or Oct. 30. Palo Alto advises limiting management interface exposure to trusted internal addresses and applying updates, while customers with Frontier Virtual Patching or Threat Prevention subscriptions can apply the available virtual patching and threat ID coverage.