PHP2Shell Exploitation Roots Palo Alto Firewalls; No WordPress Compromises Reported
Summary
Palo Alto confirmed reports that attackers chained PHP2Shell flaws with the Fragnesia privilege-escalation bug to gain root access to some firewalls. Patches are available; no WordPress compromises were known as of October 28.
Key points
- Dream reported at least 25 compromised Palo Alto firewalls among hundreds; Palo Alto said Unit 42 independently verified the attacker tooling and reported results.
- A China-linked group reportedly chained PHP2Shell CVE-2026-109618 and CVE-2026-109619 with the Fragnesia Linux kernel privilege-escalation bug to deploy root-level webshells.
- Palo Alto said exploitation targeted internet-exposed management interfaces and released fixes for PAN-OS versions 12.2, 12.1, 11.2, 11.1, and 10.2, as well as Panorama.
- As of October 29, Palo Alto telemetry identified more than 22.6 million exposed PHP instances potentially vulnerable to PHP2Shell.
- Defiant reported no known WordPress compromises via PHP2Shell as of October 28, despite recording over 77,000 related requests from more than 2,000 IP addresses.
- WatchTowr observed successful exploitation from one German IP address, but said the activity stopped after a simple curl command and showed no further post-exploitation activity.
Article Details
- Vulnerability Types
- Remote code execution
- Linux kernel privilege escalation
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict access to the Palo Alto Networks management interface, particularly from the internet.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterWatchTowr observed successful exploitation followed by execution of a simple curl command to demonstrate success.T1068 · Exploitation for Privilege EscalationThe attackers chained the Fragnesia Linux kernel privilege-escalation exploit to gain root access.T1190 · Exploit Public-Facing ApplicationAttackers exploited PHP2Shell vulnerabilities on internet-exposed PAN-OS management interfaces and other exposed PHP instances.T1505.003 · Web ShellThe attackers used the exploit chain to deploy webshells with root privileges on Palo Alto Networks firewalls.
CVE
CVE-2026-109618by AI, the hackers chained two separate exploits: one specifically targeting the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 on Palo Alto Networks’ PAN-OS devices, and another one for Fragnesia to deployCVE-2026-109619chained two separate exploits: one specifically targeting the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 on Palo Alto Networks’ PAN-OS devices, and another one for Fragnesia to deploy webshells with root
People
Vendors
Products
PA-SeriesThe company has rolled out patches that resolve the PHP2Shell flaws in PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 for PA-Series and VM-Series firewalls, and for Panorama (virtual and M-Series).PAN-OSone specifically targeting the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 on Palo Alto Networks’ PAN-OS devices, and another one for Fragnesia to deploy webshells with root privileges.PanoramaThe company has rolled out patches that resolve the PHP2Shell flaws in PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 for PA-Series and VM-Series firewalls, and for Panorama (virtual and M-Series).VM-SeriesThe company has rolled out patches that resolve the PHP2Shell flaws in PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 for PA-Series and VM-Series firewalls, and for Panorama (virtual and M-Series).WordPressThat is not surprising, given that PHP is widely used across servers and content management systems, including WordPress, Drupal, Joomla, and many others.
Countries
GermanyThe attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests.NetherlandsThe attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests.United StatesThe attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests.
Industries
AutomotiveAccording to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.ConstructionAccording to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.EducationAccording to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.HealthcareAccording to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.ManufacturingAccording to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.Non-profitAccording to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.Professional ServicesAccording to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.RetailAccording to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.security servicesAccording to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.TechnologyAccording to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.