Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
Palo Alto Networks warned on Wednesday that attackers are exploiting the PHP2Shell vulnerabilities against publicly accessible management interfaces. The flaws can allow unauthenticated remote code execution, putting affected PAN-OS and Panorama deployments at risk when management access is exposed to the internet.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, both with a CVSS score of 9.2. They affect systems running vulnerable PHP versions, while upstream fixes were released by the PHP Foundation in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026.
On PAN-OS, the affected surface is the management web interface, including the HTTPS web UI and XML API service. A dataplane interface is affected when a management profile is attached to it. Palo Alto Networks said no special configuration is required for exposure, but identified internet-reachable management interfaces as the highest-risk deployment pattern.
Fixes and mitigations
Fixed releases are available across several PAN-OS branches, including PAN-OS 12.2.4-h1, 12.1.7-h11, 11.2.4-h23, 11.1.4-h38 and 10.2.7-h39, among other branch-specific releases. Some later fixes were listed with estimated availability dates of October 29 or October 30, so administrators should match their installed branch against Palo Alto Networks' advisory rather than assume that one update applies to every deployment.
- Move incoming traffic for the management port through a dataplane port.
- Replace the certificate used for inbound traffic management.
- Decrypt inbound traffic to the management interface so the firewall can inspect it.
- Enable threat prevention for inbound traffic to management services.
The exploitation also matters because the PHP2Shell flaws have reportedly been chained with the Linux kernel privilege-escalation vulnerability Fragnesia, tracked as CVE-2026-46300. Dream said the combination was used to gain root access on 25 servers across the United States, Japan, Taiwan and South Korea, including three systems in a U.S. government-affiliated environment. Recovered artifacts reportedly showed credential extraction, directory enumeration and attacks against Active Directory.
CISA has added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog and set October 31, 2026, as the remediation deadline for federal agencies. Palo Alto Networks recommends limiting management-interface access to trusted internal IP addresses, which reduces exposure but does not replace applying the relevant PAN-OS fixes.