Palo Alto Networks has officially confirmed that cyber attackers are actively leveraging PHP2Shell vulnerabilities against exposed PAN-OS management interfaces. In an update on October 29, 2026, Palo Alto’s Unit 42 detailed how attackers have been exploiting these vulnerabilities by combining them with a Linux kernel flaw to gain elevated access.
Critical Vulnerabilities and their Impact
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, both have a critical CVSS 4.0 score of 9.2, indicating severe potential impacts. These flaws enable remote code execution without requiring user authentication. Palo Alto reported that about 0.02% of its global installations with public management interfaces are affected. The company has reached out to these affected customers directly.
This confirmation marks a significant update from earlier reports. Initially, it was not clear whether these PHP vulnerabilities had been exploited in Palo Alto products, as covered by Cyber Security News.
Mechanisms of PHP2Shell Exploitation
The PHP2Shell vulnerabilities mainly involve unsafe handling of memory when PHP encounters an error. CVE-2026-109618 is linked to improper memory management during out-of-memory errors using the longjmp() function, potentially leaving request data improperly initialized. Such mishandling can lead to remote code execution.
The second flaw, CVE-2026-109619, involves memory references that are not correctly reset, allowing attackers to exploit stale memory references. This particular flaw can be used to execute unauthorized code.
The vulnerabilities are known to affect PHP deployments such as PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Recommended updates include PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Unit 42 identified over 22.6 million potentially vulnerable instances globally, highlighting the widespread risk beyond just Palo Alto systems.
Evidence of Widespread Campaigns
Research from Dream Research identified signs of exploitation across 25 compromised PAN-OS firewall and management servers in the United States, Japan, Taiwan, and South Korea. Notably, three of these systems were linked to a US government-affiliated setting.
Attackers used customized PHP2Shell techniques targeting PAN-OS management web servers, manipulating memory to execute commands as a restricted user. Additionally, a Linux kernel flaw, referred to as Fragnesia and tracked as CVE-2026-46300, was used to obtain root access.
Despite evidence of webshell placement and internal tunneling, Dream Research could not confirm successful password spraying or backdoor account creation attempts. These findings emphasize the ongoing threat posed by these vulnerabilities.
Securing Against PHP2Shell Threats
Palo Alto’s security advisory limits the affected areas to management HTTPS interfaces and XML APIs, with PA-Series, VM-Series, and Panorama firewalls being susceptible. Other components like GlobalProtect portals and VPNs remain unaffected. Administrators are advised to remove public management access, restrict access to trusted IPs, and apply the latest PAN-OS hotfixes to mitigate these vulnerabilities.
In light of the rapid evolution of cyber threats, partly driven by AI, organizations must ensure their defenses can respond swiftly and effectively to potential attacks.
