CriticalAPT
Palo Alto Confirms Active PHP2Shell Exploitation Targeting Exposed PAN-OS Management Interfaces
Cyber Security News·Source published ·1 min read
What happened?
Palo Alto Networks has confirmed that attackers are actively exploiting PHP2Shell vulnerabilities against PAN-OS management interfaces exposed to the internet. In its October 29, 2026, update, Unit 42 said it independently verified attacker tools used to combine the PHP flaws with a Linux kernel vulnerability and gain root access. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a critical CVSS 4.0 score of 9.2. They can allow remote code execution without a login.
Key details
- Attackers chain PHP2Shell with Linux kernel flaw Fragnesia (CVE-2026-46300) to escalate from nobody user to root.
- Dream Research identified 25 compromised PAN-OS firewalls and management servers across four countries.
- Compromised systems showed webshell placement, internal tunneling, LDAP credential extraction, and Active Directory enumeration.
- Palo Alto limits affected surface to management HTTPS interface and XML API on PA-Series, VM-Series, and Panorama.
- GlobalProtect portals, gateways, Clientless VPN, and Captive Portal are not affected by these PHP flaws.
Affected
- PA-Series and VM-Series firewalls and Panorama with management HTTPS interface or XML API exposed to the internet.
What to look for
- LDAP credential extraction and Active Directory enumeration.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.