Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Ravie LakshmananOct 29, 2026Vulnerability / Network Security Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet," the network security company said in an update to its advisory. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), allow attackers to achieve unauthenticated remote code execution on systems running affected versions of PHP. The issues were patched upstream by the PHP Foundation on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The development comes days after Israeli cybersecurity company Dream said it observed a suspected China-nexus threat actor weaponizing the flaws in conjunction with a local privilege escalation bug in the Linux kernel, tracked as Fragnesia (CVE-2026-46300, CVSS score: 7.8), to root 25 servers across the U.S., Japan, Taiwan, and South Korea. Among those were three systems belonging to a U.S. government-affiliated environment. "The affected devices run specific versions of a large vendor's firewall software," Dream noted. "The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration." Although Dream did not disclose the name of the affected firewall vendor, the timing of the advisory, combined with the fact that other network security companies have not reported malicious exploitation against their products, suggests that these events may be related. The Hacker News has contacted both Dream and Palo Alto Networks for comment, and we will update the story if we hear back. The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the fixes by October 31, 2026. "This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP web shells and run commands as root," CISA said. Palo Alto Networks has also noted that no special configuration is required to be affected by this issue, adding the risk is highest on PAN-OS when access to the management interface is allowed from external IP addresses on the internet. "This issue strictly affects the management web interface, which includes the HTTPS web UI and XML API service," it said. "It affects the dataplane interface only if a management profile is attached to it." The following versions of PAN-OS are impacted by PHP2Shell - < 12.1.4-h13 (Fixed in >= 12.1.4-h13) (ETA: 10/29) < 12.1.10-h3 (Fixed in >= 12.1.10-h3) (ETA: 10/30) < 11.2.4-h23 (Fixed in >= 11.2.4-h23) (ETA: 10/30) < 11.1.7-h12 (Fixed in >= 11.1.7-h12) (ETA: 10/30) < 10.2.7-h39 (Fixed in >= 10.2.7-h39) (ETA: 10/30) < 10.2.10-h42 (Fixed in >= 10.2.10-h42) (ETA: 10/29) For PAN-OS versions where fix versions are not yet available, Palo Alto Networks has recommended the following mitigations - Route incoming traffic for the MGT port through a DP port, e.g., enabling management profile on a DP interface for management access. Replace the Certificate for Inbound Traffic Management. Decrypt inbound traffic to the management interface so the firewall can inspect it. Enable threat prevention on the inbound traffic to management services. "Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 and later versions received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on October 20," it said. "The security risk posed by this issue on PAN-OS and Panorama is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cyber Attack, network security, Vulnerability, Web Security Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor No Exploit Yet? Preview the Summit Demo on Validating CVE Exposure Download the 2026 Agent Security Report for a Five-Step Risk Reduction Framework Get the Five-Stage Identity Maturity Roadmap for Governing AI Agents Benchmark Your AI Risk Priorities Against 1,600 CISOs—Download the 2026 Report Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Session Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. FBI Cyber Division's Brett Leatherman Keynotes SANS CDI 2026, Dec 15 Join SANS CEO James Lyne and the FBI on ransomware disruption and intel sharing, during SANS training in D.C. See how Identity Dark Matter impacts your GRC, IR, and Infrastructure. Watch the video. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security The Least Trusted Author Sets the AI Agent's Privilege Security Rests on Hard Math Problems. Quantum and AI Are Both Coming for Them