Palo Alto Confirms Active PHP2Shell Exploitation Against PAN-OS Management Interfaces
Summary
Palo Alto confirmed active exploitation of PHP2Shell flaws in internet-exposed PAN-OS management interfaces. A separate report describes a suspected China-nexus actor chaining the flaws with Fragnesia; hotfixes and mitigation guidance are available.
Key points
- CVE-2026-109618 and CVE-2026-109619 enable unauthenticated remote code execution through affected PAN-OS management interfaces.
- Palo Alto confirmed active exploitation on October 28, 2026; affected releases include PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, and Panorama.
- Dream reported that a suspected China-nexus actor chained PHP2Shell with Fragnesia (CVE-2026-46300) and gained root access on 25 firewalls; the firewall vendor was not identified.
- Dream’s account describes web shells, reverse SSH tunnels, LDAP service-account password access, password spraying and Active Directory reconnaissance.
- Palo Alto hotfixes are available for most affected branches; the article says fixes for remaining branches were scheduled for October 29 and 30, 2026.
- Patching does not remove existing web shells, tunnels or stolen credentials. Recommended steps include restricting management access, checking for compromise, rotating exposed credentials and reviewing Active Directory activity.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution
- Linux kernel privilege escalation
- Severity
- 8.7 (High), assigned by Palo Alto Networks
- Affected Versions
- PAN-OS 10.2
- PAN-OS 11.1
- PAN-OS 11.2
- PAN-OS 12.1
- PAN-OS 12.2
- PHP 8.0.30
- Exploitation Status
- active
- Exploit Availability
- public_exploit
- Patch Status
- partial
- Workarounds
- Restrict management access to trusted internal IP addresses.
- For branches awaiting hotfixes, route management access through a dataplane interface, decrypt inbound management traffic, and enable threat prevention.
- Apply the Fragnesia fix on Linux systems.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThe reported campaign chained Fragnesia, a Linux kernel privilege escalation vulnerability, with PHP2Shell to gain root access.T1087.002 · Domain AccountThe threat actor used an LDAP service account to enumerate the Active Directory directory.T1110.003 · Password SprayingThe threat actor ran password spraying against Active Directory after gaining access to firewalls.T1190 · Exploit Public-Facing ApplicationThe suspected threat actor used automated exploitation to gain unauthenticated remote code execution through internet-exposed firewall management interfaces.T1505.003 · Web ShellAfter compromising firewalls, the threat actor deployed web shells.T1572 · Protocol TunnelingThe threat actor opened reverse SSH tunnels after compromising firewalls.
CVE
CVE-2026-109618The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution on affected devices.CVE-2026-109619The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution on affected devices.CVE-2026-46300documented a campaign in which a suspected China-nexus threat actor chained PHP2Shell with Fragnesia (CVE-2026-46300), a Linux kernel privilege escalation vulnerability, to compromise internet-facing firewall
Vendors
Products
PAN-OSOn October 28, 2026, Palo Alto Networks confirmed active exploitation of the PHP2Shell vulnerabilities against PAN-OS management interfaces exposed to the internet.PanoramaPAN-OS is the operating system of Palo Alto Networks next-generation firewalls, and Panorama is its centralized management platform.Ruggedcom APE1808Siemens published advisory SSA-566512 on October 23, 2026, for the RUGGEDCOM APE1808, which runs PAN-OS.
Tools
Countries
JapanThe threat actor gained root access on 25 firewalls across the United States, Japan, Taiwan, and South Korea, including three systems in a U.S.South KoreaThe threat actor gained root access on 25 firewalls across the United States, Japan, Taiwan, and South Korea, including three systems in a U.S.TaiwanThe threat actor gained root access on 25 firewalls across the United States, Japan, Taiwan, and South Korea, including three systems in a U.S.United StatesThe threat actor gained root access on 25 firewalls across the United States, Japan, Taiwan, and South Korea, including three systems in a U.S.