PHP2Shell Attacks Successfully Target Palo Alto Firewalls

Recent PHP2Shell Attacks

Threat actors have increasingly targeted servers vulnerable to PHP2Shell for over a week, with reports indicating only a few successful compromises to date. Among the significant targets are Palo Alto Networks firewalls, which were exploited by a hacking group linked to China. This attack involved chaining exploits by linking PHP2Shell with the Fragnesia kernel privilege escalation bug.

Details of the Attack

Cybersecurity outfit Dream flagged this ongoing campaign earlier this week, revealing that at least 25 firewalls out of a pool of hundreds have been successfully hacked. Palo Alto Networks has corroborated these findings, stating:
. "Dream Research reported a campaign in which attackers chained PHP2Shell with a Linux kernel privilege-escalation vulnerability to gain root access. . Unit 42 could independently validate the attacker’s tools and confirm Dream’s results."

Exploited Vulnerabilities

The attackers specifically targeted the PHP2Shell vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, on Palo Alto Networks' PAN-OS devices, alongside exploiting the Fragnesia vulnerability to deploy webshells with root access. Recognizing the gravity of the situation, Palo Alto Networks swiftly rolled out patches that resolve these PHP2Shell flaws across various versions of PAN-OS. These include versions 12.2, 12.1, 11.2, 11.1, and 10.2 for PA-Series and VM-Series firewalls, as well as for Panorama, both virtual and M-series. "No specific configuration is needed for systems to be susceptible to this issue. Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet," the company's advisory stated.

Patching and Prevention Measures

To mitigate these vulnerabilities, Palo Alto Networks has urged customers to immediately restrict access to their management interface and to apply the available updates. The company reassured that approximately .02% of its global installed base had internet-facing management interfaces configured and affected. All impacted customers have been individually contacted by the cybersecurity firm. As per their telemetry, the company found that over 22.6 million PHP instances are exposed and potentially vulnerable.

The Broader PHP2Shell Campaign

While the mass exploitation of PHP2Shell targets servers across various platforms including WordPress, security firm Defiant reported that success rates have been largely minimal, especially within WordPress. As of October 28 and despite noting over 77,000 requests linked to PHP2Shell from more than 2,000 IP addresses, they were unaware of any WordPress sites being compromised via this method.

Attack Dynamics and Statistics

Despite the alarming number of PHP2Shell exploitation attempts, only a small number have resulted in successful breaches, attributed to a handful of threat actors. Cato Networks noted that roughly 96% of blocked attacks targeted CVE-2026-109618, while 41% sought remote code execution (RCE). These attempts were concentrated and generally opportunistic. Attack attempts were traced back to a select few IP addresses located in the US, the Netherlands, and Germany, employing a proof-of-concept (PoC) style of requests focusing primarily on command execution.

Specific Sectors Targeted

The attacks primarily targeted sectors such as healthcare, technology and security services, professional services, education, non-profit, automotive, manufacturing, construction, and retail. Although these attacks are opportunistic in nature, corresponding request patterns were noted, indicating a lack of specific targeting despite the varied nature of the organizations involved.

Successful Exploits

While reports of successful PHP2Shell exploitation were rare, WatchTowr did identify successful intrusions from a single IP address in Germany. According to the head of threat intelligence at WatchTowr, Jake Knott, the exploit executed a simple "curl" command as proof of success but ceased further post-exploitation activities. He noted, "New techniques, inventive payloads, and appliance-specific exploits are evolving as more reliable options are developed. Publicly reported successful exploits will likely continue to rise, particularly for specific edge appliances."

Conclusion

The ongoing PHP2Shell exploits against Palo Alto firewalls and several other systems emphasize the imperative for organizations to implement timely patching and access restrictions. With over 22.6 million PHP instances exposed, sectors such as healthcare remain particularly vulnerable. Compromises this week illustrate the continuing evolution and opportunism of cyber threats in the current landscape.

Key Takeaways

• PHP2Shell has exploited Palo Alto Networks firewalls with over 25 confirmed breaches.
• CVE-2026-109618 and CVE-2026-109619 serve as the primary vulnerabilities exploited.
• Palo Alto has patched PAN-OS versions 10.2 to 12.2 to address these vulnerabilities.
• 22.6 million PHP instances are potentially exposed, heightening security risks.
• Healthcare and technology sectors are primarily targeted by ongoing PHP2Shell attacks.