Palo Alto Networks has confirmed active exploitation of PHP2Shell vulnerabilities against PAN-OS management interfaces that were exposed to the internet. In an October 29, 2026 update, Unit 42 verified that attackers combined the PHP flaws with a Linux kernel vulnerability to escalate from remote code execution to full root access on affected systems. The vendor says the attack surface was limited to publicly reachable management HTTPS interfaces and the XML API, and that roughly 0.02% of its global installed base had public management interfaces configured and was impacted.
What PHP2Shell is and how it works
Both tracked flaws, CVE-2026-109618 and CVE-2026-109619, are rooted in unsafe memory handling when PHP aborts request processing after an error. CVE-2026-109618 arises from out-of-memory handling through longjmp(), which can leave request data partially initialized so cleanup routines may later access invalid data. CVE-2026-109619 involves stale references to memory that PHP has already freed, allowing subsequent requests handled by the same worker to reach and abuse those stale pointers. Each vulnerability carries a critical CVSS 4.0 score of 9.2 and can allow remote code execution without authentication in exposed PHP deployments.
Scope of vulnerable PHP deployments and available fixes
The PHP Group’s advisory identifies common deployment types that can be exposed, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Fixed PHP releases were published as PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Unit 42 estimated more than 22.6 million exposed PHP instances worldwide that could be potentially vulnerable—this figure describes possible PHP exposure in general and is not the same as confirmed Palo Alto firewall compromises.
What was observed in the PAN-OS campaign
Independent researchers at Dream Research found artifacts pointing to a campaign that compromised 25 PAN-OS firewall and management servers across the United States, Japan, Taiwan, and South Korea, including three systems in a U.S. government-affiliated environment. According to the findings, attackers used a custom PHP2Shell implementation targeting the PAN-OS management web server: specially crafted upload requests created memory pressure, leaked addresses, and manipulated in-process memory structures to execute commands as the restricted nobody user. The attackers then leveraged a separate Linux kernel flaw, Fragnesia (CVE-2026-46300), to escalate privileges to root.
Observed post-exploitation activity included webshell placement, internal tunneling, LDAP credential extraction, and Active Directory enumeration. Dream Research could not confirm whether subsequent password spraying or the creation of backdoor accounts succeeded on the affected systems.
Clarifying earlier reporting
This confirmation should not be mixed with Unit 42’s earlier, retracted October 23 update. The initial update linked activity at a European government agency to PHP2Shell, but investigators later said they could not establish those flaws as the initial access vector in that case. The October 29 confirmation specifically addresses the PAN-OS campaign described above.
Which PAN-OS features are affected and which are not
Palo Alto’s advisory narrows the affected surface to the management HTTPS interface and XML API for PA-Series, VM-Series firewalls and Panorama. Notably, GlobalProtect portals and gateways, Clientless VPN and Captive Portal are not affected by these PHP flaws. A dataplane interface is exposed only if a management profile is attached, which limits unintended exposure in typical dataplane configurations.
Immediate mitigation and vendor patches
Palo Alto recommends administrators immediately remove public management access and restrict management interfaces to trusted internal IP addresses. The vendor also published PAN-OS hotfixes to address the PHP vulnerabilities and to interrupt the observed attack chain. Fixed PAN-OS options cited include 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4 and 10.2.18-h13, with additional fixes available for other maintenance releases. Administrators should prioritize removing public management exposure and apply the appropriate hotfix promptly.
A reminder on threat tempo
Unit 42’s confirmation and Dream Research’s campaign artifacts underline how attackers can chain application-level memory corruption with kernel exploits to achieve rapid and complete compromise. The report concludes with a practical warning: as tooling and automation improve, attackers can move faster—defenders must prioritize attack surface reduction and timely patching to keep pace.
Licensed under CC BY-ND 4.0 International