Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces

Palo Alto Networks has confirmed that attackers are actively abusing the PHP2Shell bugs against internet-facing management interfaces of its firewalls. The flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), enable unauthenticated remote code execution on vulnerable PHP installations and were fixed upstream by the PHP Foundation on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Security firm Dream previously reported that a suspected China-linked actor combined these flaws with the Linux kernel privilege-escalation bug Fragnesia (CVE-2026-46300, CVSS 7.8) to gain root on 25 servers across the US, Japan, Taiwan and South Korea, including three tied to a US government environment, then went on to harvest Active Directory credentials. CISA has added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 31, 2026 to remediate, while Palo Alto Networks has released patches for multiple PAN-OS branches and urges customers to restrict management interface access to trusted internal addresses as a stopgap.