Cybersecurity concerns have intensified as threat actors exploit vulnerabilities in PHP2Shell, impacting servers globally. Over the past week, these malicious activities have primarily targeted Palo Alto Networks firewalls, marking them as a key focus for attackers.
Palo Alto Networks Firewalls Under Attack
Recent findings reveal that a China-linked hacking group has successfully breached Palo Alto Networks firewalls by exploiting PHP2Shell vulnerabilities alongside the Fragnesia kernel privilege escalation bug. These breaches have been facilitated by AI, allowing hackers to combine two separate exploits. Specifically, they targeted vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619 on PAN-OS devices, in conjunction with Fragnesia, to deploy webshells with root access.
The cybersecurity firm Dream highlighted this campaign, confirming that at least 25 firewalls were compromised. Palo Alto Networks acknowledged these incidents, stating that their Unit 42 team has validated the attack techniques and confirmed the outcomes.
Security Measures and Recommendations
Palo Alto Networks has issued patches to address the PHP2Shell flaws in various versions of PAN-OS for PA-Series and VM-Series firewalls, as well as Panorama systems. The company stresses that no unique configurations are needed for the systems to be vulnerable. They urge users to restrict internet access to management interfaces and apply the necessary updates immediately.
According to Palo Alto Networks, only a minimal portion of their global user base had internet-facing management interfaces affected. Each affected customer has been contacted to ensure swift remediation.
Wider PHP2Shell Exploitation Trends
Telemetry data from the company shows over 22.6 million exposed PHP instances that could potentially be vulnerable to PHP2Shell. Despite the widespread attempts at exploitation, the impact on WordPress sites has been negligible. Web security firm Defiant reports no successful PHP2Shell attacks against WordPress, despite numerous attempts recorded from multiple IP addresses.
Defiant emphasizes the need for vigilance, as attackers continuously adapt their tools and techniques. They highlight the importance of keeping PHP updated to safeguard site files, databases, and credentials from potential threats.
Opportunistic Attacks and Future Outlook
Analysis by Cato Networks shows that most attacks aimed at CVE-2026-109618, with a significant portion attempting remote code execution. These attempts were mainly opportunistic, originating from a few IPs across the US, Netherlands, and Germany. Healthcare, technology, and security services industries were among the most targeted sectors.
WatchTowr observed that successful PHP2Shell exploitations were rare, with one notable case from Germany. These attempts often involved a simple command execution to confirm vulnerability, with no further malicious actions.
As attackers refine their methods, the cybersecurity community anticipates more sophisticated and targeted exploits. Ongoing vigilance and timely updates remain critical in mitigating these evolving threats.
