Palo Alto Networks confirms active exploitation of PHP2Shell flaws in exposed management interfaces

Palo Alto Networks has confirmed that threat actors are actively exploiting critical PHP vulnerabilities in its firewall management interfaces exposed to the public internet. The warning, issued on Wednesday, follows reports from cybersecurity firm Dream regarding a suspected China-nexus group compromising servers across multiple countries. This development marks a significant escalation in the exploitation of the recently patched PHP2Shell flaws.

What happened

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2 and allow unauthenticated remote code execution on systems running affected PHP versions. These issues were patched by the PHP Foundation on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. However, attackers are now targeting devices that have not yet been updated or remain exposed to external traffic.

Cybersecurity company Dream reported observing a threat actor chaining these PHP flaws with a Linux kernel privilege escalation bug, tracked as Fragnesia (CVE-2026-46300). This combination allowed the attackers to gain root access to 25 servers in the U.S., Japan, Taiwan, and South Korea, including three systems linked to a U.S. government-affiliated environment. The attackers subsequently targeted Active Directory, extracting credentials and enumerating directory structures.

In response, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply fixes by October 31, 2026. CISA noted that this vulnerability can be chained with the PHP flaws to implant web shells and execute commands with root privileges. Palo Alto Networks stated that while only a small fraction of its global installed base has internet-facing management interfaces, those customers have been individually contacted.

Key details

• Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) enable unauthenticated remote code execution via PHP2Shell flaws.
• Exploitation chain: Attackers combine PHP flaws with CVE-2026-46300 (Fragnesia, CVSS 7.8) to achieve root access on Linux-based firewall systems.
• Impact scope: Dream observed compromises on 25 servers across the U.S., Japan, Taiwan, and South Korea, including U.S. government-affiliated systems.
• Affected interface: The issue strictly affects the management web interface (HTTPS UI and XML API), particularly when exposed to external IP addresses.
• Patch status: Fixes are available for most PAN-OS versions, with some releases expected by October 30, 2026.
• Vendor response: Palo Alto Networks confirmed the exploitation and urged immediate removal of public internet access to management interfaces.

Background

PHP2Shell refers to a class of vulnerabilities in PHP that allow attackers to execute arbitrary system commands through web applications. When such flaws exist in network device management interfaces, they provide a direct path for attackers to take control of the underlying operating system. In this case, the firewall runs a Linux-based OS, making it susceptible to local privilege escalation bugs like Fragnesia once initial access is gained.

Management interfaces on firewalls are designed for administrative tasks and should ideally be accessible only from trusted internal networks. Exposing these interfaces to the public internet increases the attack surface significantly, as it allows anyone to attempt authentication brute-forcing or exploit unpatched vulnerabilities. Best practices dictate restricting access to specific internal IP ranges and using virtual private networks (VPNs) for remote administration.

Why it matters

For teams managing their own infrastructure, this incident highlights the critical importance of network segmentation and strict access controls. Even if you patch your systems promptly, exposing management ports to the internet leaves them vulnerable to zero-day exploits or rapid exploitation of newly disclosed flaws. The speed at which threat actors chained these vulnerabilities demonstrates that defense-in-depth strategies are essential, not optional.

Self-hosting environments often rely on perimeter security devices like firewalls to protect internal services. If the firewall itself is compromised, the entire internal network becomes vulnerable. The extraction of Active Directory credentials mentioned in the report suggests that attackers use these footholds to move laterally, potentially compromising email servers, databases, and other critical business applications. Ensuring that management interfaces are never publicly accessible is a fundamental step in protecting your self-hosted stack.

What you can do

• Restrict access immediately: Ensure that firewall management interfaces are not accessible from the public internet. Allow connections only from trusted internal IP addresses.
• Apply patches: Update PAN-OS to the fixed versions listed in the advisory. Check for updates daily until all relevant versions are patched.
• Enable threat prevention: If you cannot patch immediately, enable threat prevention profiles on inbound traffic to management services and decrypt inbound traffic for inspection.
• Audit exposure: Use attack surface management tools to verify that no management ports are accidentally exposed to the internet.
• Monitor logs: Review firewall logs for unusual access patterns or failed authentication attempts on the management interface.
• Replace certificates: As a mitigation step, replace the certificate used for inbound traffic management to disrupt potential man-in-the-middle attacks.