Attackers Exploit PHP2Shell Flaws Against Internet-Exposed Palo Alto Management Interfaces
Summary
Palo Alto Networks says attackers are exploiting PHP2Shell flaws against internet-exposed management interfaces. The article covers PHP fixes, PAN-OS exposure and mitigations, and Dream’s separate report of a suspected campaign involving Fragnesia.
Key points
- Palo Alto Networks reported active exploitation targeting its management interfaces exposed to the internet; it said no special configuration is required for exposure.
- CVE-2026-109618 and CVE-2026-109619 enable unauthenticated remote code execution on affected PHP versions. The PHP Foundation patched them on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- Palo Alto said risk is highest when PAN-OS management access is allowed from external IP addresses. The issue affects the HTTPS web UI and XML API; dataplane interfaces are affected only when a management profile is attached.
- Dream reported that a suspected China-nexus actor chained the PHP flaws with the Linux kernel flaw Fragnesia (CVE-2026-46300) to gain root access on 25 servers. Dream cited recovered artifacts showing credential extraction and directory enumeration; a connection to the Palo Alto exploitation has not been confirmed.
- CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog and set an October 31, 2026, remediation deadline for federal agencies.
- Palo Alto recommended restricting management-interface access to trusted internal IP addresses; it also said Frontier Virtual Patching provided advance coverage for PAN-OS 12.2.4 and later.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution
- Local privilege escalation
- Severity
- CVSS 9.2 for CVE-2026-109618 and CVE-2026-109619; CVSS 7.8 for CVE-2026-46300.
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Restrict access to the management interface to trusted internal IP addresses.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationDream reported that a suspected China-nexus actor chained the Linux kernel vulnerability Fragnesia with PHP2Shell to gain root access on servers.T1190 · Exploit Public-Facing ApplicationPalo Alto Networks reported active exploitation targeting its management interface when exposed to the internet.T1505.003 · Web ShellCISA stated that chaining the vulnerabilities can implant PHP web shells and enable commands to run as root.
CVE
CVE-2026-109618The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), allow attackers to achieve unauthenticated remote code execution on systems running affected versions of PHP. The issues wereCVE-2026-109619The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), allow attackers to achieve unauthenticated remote code execution on systems running affected versions of PHP. The issues wereCVE-2026-46300flaws in conjunction with a local privilege escalation bug in the Linux kernel, tracked as Fragnesia (CVE-2026-46300, CVSS score: 7.8), to root 25 servers across the U.S., Japan, Taiwan, and South Korea.
Vendors
Palo Alto NetworksPalo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces.The PHP Foundationcode execution on systems running affected versions of PHP. The issues were patched upstream by the PHP Foundation on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Products
PAN-OSthat no special configuration is required to be affected by this issue, adding the risk is highest on PAN-OS when access to the management interface is allowed from external IP addresses on the internet.Panorama"The security risk posed by this issue on PAN-OS and Panorama is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deploymentPHPallow attackers to achieve unauthenticated remote code execution on systems running affected versions of PHP. The issues were patched upstream by the PHP Foundation on October 21, 2026, in versions 8.5.12, 8.4.27,
Countries
JapanLinux kernel, tracked as Fragnesia (CVE-2026-46300, CVSS score: 7.8), to root 25 servers across the U.S., Japan, Taiwan, and South Korea.South Koreaas Fragnesia (CVE-2026-46300, CVSS score: 7.8), to root 25 servers across the U.S., Japan, Taiwan, and South Korea.Taiwantracked as Fragnesia (CVE-2026-46300, CVSS score: 7.8), to root 25 servers across the U.S., Japan, Taiwan, and South Korea.United Statesin the Linux kernel, tracked as Fragnesia (CVE-2026-46300, CVSS score: 7.8), to root 25 servers across the U.S., Japan, Taiwan, and South Korea.