On Wednesday, Palo Alto Networks issued a warning regarding the exploitation of PHP2Shell vulnerabilities within publicly accessible management interfaces. This security alert highlights a significant threat to systems running affected PHP versions, as these vulnerabilities are being actively targeted by malicious actors.
Active Exploitation of PHP2Shell Vulnerabilities
The identified vulnerabilities, designated as CVE-2026-109618 and CVE-2026-109619, have been given a CVSS score of 9.2, indicating their critical nature. They allow attackers to execute remote code without authentication on compromised systems. The PHP Foundation addressed these vulnerabilities with patches released on October 21, 2026, for PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Threat Actor Activity and Cybersecurity Concerns
In a related development, Israeli cybersecurity firm Dream reported observing a threat actor, possibly linked to China, exploiting these vulnerabilities. This actor combined the PHP2Shell flaws with a Linux kernel privilege escalation bug, known as Fragnesia (CVE-2026-46300, CVSS score: 7.8), to compromise 25 servers across various countries including the U.S., Japan, Taiwan, and South Korea. Among these were systems associated with a U.S. government-affiliated entity.
Dream’s findings suggest that affected systems are running specific versions of firewall software. The attacker leveraged these vulnerabilities to extract credentials and conduct directory enumeration via Active Directory attacks.
Implications and Preventative Measures
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has responded by adding CVE-2026-46300 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to implement fixes by October 31, 2026. CISA emphasized the potential for these vulnerabilities to be used in tandem to implant PHP web shells and execute commands with root privileges.
Palo Alto Networks stated that affected PAN-OS versions do not require special configurations to be at risk when management interfaces are accessible from the internet. The vulnerability specifically impacts the management web interface, including the HTTPS web UI and XML API service.
Mitigation Strategies and Best Practices
For PAN-OS versions pending updates, Palo Alto Networks recommends several mitigation strategies. These include rerouting management traffic through a DP port, replacing inbound traffic management certificates, decrypting traffic to allow firewall inspection, and enabling threat prevention services.
The company reassures that employing their best practice guidelines, which restrict management interface access to trusted internal IP addresses, can substantially reduce security risks. Moreover, customers utilizing Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 and later have benefited from preemptive protections introduced via Threat ID 543004 on October 20.
This evolving situation underscores the importance of maintaining up-to-date security measures and adhering to recommended configurations to safeguard against these vulnerabilities.
