PHP2Shell exploited against firewalls

Threat summary

On October 28, 2026, Palo Alto Networks updated its advisory to confirm active exploitation of the PHP2Shell vulnerabilities against internet-exposed PAN-OS management interfaces. The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution on affected devices.

The PHP Foundation patched them upstream on October 21, 2026, and Palo Alto Networks is releasing PAN-OS-specific hotfixes because its appliances bundle their own PHP runtime.

PAN-OS is the operating system of Palo Alto Networks next-generation firewalls, and Panorama is its centralized management platform. The affected component is the management web interface, which includes the HTTPS web user interface and the Extensible Markup Language (XML) API. Traffic passing through the firewall is not affected, and dataplane interfaces are exposed only when a management profile is attached to them.

Affected releases include :

• PAN-OS:

  • 10.2

  • 11.1

  • 11.2

  • 12.1

  • 12.2

• Panorama

Each device requires the hotfix for its maintenance release or a later version, and Palo Alto Networks assigned a product-specific severity score of 8.7 (High). Siemens published advisory SSA-566512 on October 23, 2026, for the RUGGEDCOM APE1808, which runs PAN-OS.

Separately, researchers at Dream documented a campaign in which a suspected China-nexus threat actor chained PHP2Shell with Fragnesia (CVE-2026-46300), a Linux kernel privilege escalation vulnerability, to compromise internet-facing firewall management interfaces. The threat actor gained root access on 25 firewalls across the United States, Japan, Taiwan, and South Korea, including three systems in a U.S. government-affiliated environment. Dream withheld the name of the firewall vendor.

The threat actor used the FOFA search engine to find exposed firewall management interfaces, narrowed the results to vulnerable versions, and gained access through automated exploitation. The exploit was custom built for the target platform and abused PHP session upload progress handling on the management web server, which runs PHP 8.0.30 with a high memory limit.

After compromise, the threat actor deployed web shells, opened reverse SSH tunnels, obtained a Lightweight Directory Access Protocol (LDAP) service account password, and ran password spraying and reconnaissance against AD.

On October 28, 2026, CISA added Fragnesia to its Known Exploited Vulnerabilities (KEV) catalog, noting that it can be chained with PHP2Shell to deploy web shells and run commands as root.

Analysis

Organizations with PAN-OS or Panorama management interfaces reachable from the internet face the highest exposure, including operators of Siemens RUGGEDCOM APE1808 devices. Firewalls with a management profile on an internet-facing dataplane interface carry the same exposure and are easy to miss in asset reviews because they are inventoried as traffic interfaces.

Firewalls are attractive targets because they see all traffic crossing the perimeter, store credentials for directory and authentication integrations, and typically sit outside endpoint detection coverage.

Exploitation requires network access to a page served by a vulnerable PHP build and works without credentials or user interaction. A single malicious multipart request can trigger the flaw before any application code runs, and an adversary can also read memory from the PHP worker process, which may hold passwords, authentication tokens, API keys, and certificates from other requests.

On generic web servers, exploitation is difficult because each PHP build has unique memory offsets, and researchers at Sansec and VulnCheck found that public exploits fail against default PHP installations. Appliances remove that obstacle. Each firmware version ships a single PHP build, so an exploit tuned to one version works on every device running it.

Further impact depends on how each firewall is integrated. A firewall that authenticates users or administrators against AD holds a service account that can enumerate the directory. A firewall that terminates remote access VPN connections could expose user sessions, and a firewall that bridges network segments could let an adversary reach systems its own policy is meant to isolate, as happened when the threat actor reached an internal management server only accessible through the tunnel.

Patching closes the vulnerability but leaves web shells, tunnels, and stolen credentials in place.

Mitigations

Upgrading affected PAN-OS and Panorama devices to the fixed hotfix for their maintenance release removes the vulnerable PHP code from the management interface.

Devices on PAN-OS 12.2 require 12.2.4-h1 or later, and devices on 12.1, 11.2, 11.1, and 10.2 require the hotfix listed for their maintenance release.

Restricting management access to trusted internal IP addresses removes the external attack path used in the observed exploitation. Reviewing dataplane interfaces for attached management profiles identifies management access points that standard asset inventories can miss.

For branches still awaiting hotfixes, Palo Alto Networks’ compensating controls (routing management access through a dataplane interface, decrypting inbound management traffic, and enabling threat prevention) let the firewall inspect management traffic and block known exploit attempts before they reach the PHP component.

Reviewing firewalls with internet-accessible management interfaces for signs of compromise identifies systems breached before patching. Useful indicators include:

• Unexpected outbound SSH connections

• Web shells

• Unusual administrative activity

• Credential access attempts

• AD reconnaissance

Rotating credentials used by exposed firewalls, including LDAP service accounts and administrative accounts, removes access obtained during exploitation. To identify follow-on activity from a compromised device, review AD for:

• Password spraying

• Newly created accounts

• Other unauthorized changes

Applying the Fragnesia fix on Linux systems removes the privilege escalation path chained with PHP2Shell. Updating standalone PHP servers to fixed releases closes the same vulnerabilities outside PAN-OS.

Forwarding firewall logs to a security information and event management (SIEM) platform preserves evidence that an intruder could erase from the appliance and provides visibility into exploitation attempts, administrative activity, and post-compromise behavior.

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up