Attackers Exploit PHP2Shell on Internet-Exposed Palo Alto Firewall and Panorama Management Pages

Palo Alto Networks now says attackers are exploiting the PHP2Shell flaws against its firewalls and Panorama management servers when the management web page is exposed to the internet. In an update to its security advisory for CVE-2026-109618 this week, the company states: "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet."

What PHP2Shell is. CVE-2026-109618 and CVE-2026-109619 are two flaws in PHP, the programming language behind many web pages and device web interfaces. Either one can let an attacker with no username or password run their own code on the system, which is called remote code execution. PAN-OS, the operating system on Palo Alto Networks firewalls, uses PHP in its management web interface. Palo Alto Networks rates the issue Critical, 9.2 out of 10 on version 4 of the Common Vulnerability Scoring System (CVSS), with its highest suggested urgency. Palo Alto Networks has not said who is behind the attacks or how many devices were hit.

What is affected. According to Palo Alto Networks, the flaws affect PAN-OS on PA-Series hardware firewalls, VM-Series virtual firewalls and Panorama, the central server that manages many Palo Alto firewalls, in both its virtual and M-Series appliance forms. No special configuration is needed to be affected. The flaws are strictly in the management web interface. That includes the secure web page administrators log in to, served over Hypertext Transfer Protocol Secure (HTTPS), and the Extensible Markup Language (XML) application programming interface (API) that scripts and tools use. A regular traffic port, which Palo Alto calls a dataplane interface, is affected only if a management profile is attached to it, meaning management access was turned on for that port. The GlobalProtect remote access portal and gateway, Clientless virtual private network (VPN) and Captive Portal are not affected. Palo Alto Networks says the risk is highest when the management interface can be reached from addresses on the internet.

Fixed hotfixes. Palo Alto Networks lists these fixed hotfix releases, or any later release, for each PAN-OS version line:
PAN-OS 12.2: 12.2.4-h1
PAN-OS 12.1: 12.1.4-h13, 12.1.7-h11 or 12.1.10-h3
PAN-OS 11.2: 11.2.4-h23, 11.2.7-h23, 11.2.10-h16, 11.2.13-h4 or 11.2.16-h1
PAN-OS 11.1: 11.1.4-h38, 11.1.6-h40, 11.1.7-h12, 11.1.10-h36, 11.1.13-h16 or 11.1.16-h4
PAN-OS 10.2: 10.2.7-h39, 10.2.10-h42, 10.2.13-h27, 10.2.16-h12 or 10.2.18-h13
As of the 29 October update, the only hotfix still marked with an estimated date is 11.1.7-h12, expected 30 October. The advisory's upgrade table says firewalls on 11.1.7 can move to 11.1.16-h4 instead. Older, unsupported PAN-OS versions should be upgraded to a supported fixed version. The same hotfix also fixes a separate flaw in the Brotli compression library, with one exception: 11.2.10-h16 fixes only the PHP flaws, and 11.2.10-h17 fixes both.

Signatures are not a substitute. Palo Alto Networks lists Threat Prevention signatures, starting with Threat ID 543004, that detect these attacks. The advisory says they only protect the management interface if management traffic is routed through a dataplane port, the inbound management certificate is replaced, and that traffic is decrypted and inspected with threat prevention turned on. A firewall managed through its dedicated management port does not get that protection from the signatures alone. Palo Alto Networks says the risk is minimized by allowing only trusted internal addresses to reach the management interface, and it recommends a jump box, one hardened system that is the only one allowed to connect to it.

What CISA and researchers have said. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on 26 October, with a due date of 29 October for federal civilian agencies, and marked both for forensic triage, meaning agencies should check for compromise, not just patch. On 28 October, CISA added the Linux kernel flaw Fragnesia, CVE-2026-46300, with a 31 October due date, and said it can be chained with PHP2Shell to implant PHP web shells, small hidden programs that act as a back door, and run commands as root, the all-powerful administrator account. Separately, Dream Research reported on 26 October that an attacker it suspects is linked to China used that chain to take over 25 systems running a large vendor's firewall software. Dream did not name the vendor. The Hacker News reported on 29 October that the timing suggests the events may be related. Neither Dream nor Palo Alto Networks has confirmed a link, and Red Tiger is not drawing one. Red Tiger covered the chain on 28 October: https://www.redtigersecurity.com/advisory/php2shell-fragnesia-firewall-chain

Where this shows up from the plant floor to the cloud. Palo Alto firewalls are common at the boundary between business networks and control system networks, also called operational technology (OT), in the demilitarized zone (DMZ), the buffer network between the two, and at remote sites such as pump stations, substations and compressor stations. Panorama often manages all of them from one place, in a corporate data center or a public cloud, and VM-Series firewalls protect the cloud systems that collect plant data. The weak spots are management pages left reachable from the internet so an integrator or remote engineer can get in, and management profiles turned on for an outside-facing port during a project and never turned off. A firewall an attacker controls can open paths into the control network and hand over the passwords and network details stored in its configuration. A compromised Panorama puts every firewall it manages at risk.

What the Red Tiger team recommends:

1. Lock down management access today. Make sure no firewall or Panorama management page or XML API can be reached from the internet. Limit management to a jump box or a short list of trusted internal addresses, and check every dataplane interface, especially internet-facing and remote site ports, for an attached management profile.
2. Install the fixed hotfix. Use the advisory's table to pick the right hotfix for each firewall and Panorama, and schedule the work with operations. Plan the order with your network team, because Panorama generally needs to run the same or a newer version than the firewalls it manages.
3. Check for compromise, not just the patch level. Because exploitation is confirmed, look for unknown files, unknown admin accounts, configuration changes nobody made and unexpected outbound connections from firewalls and Panorama. If anything looks wrong, rebuild from a known-good image and reset the passwords and service accounts stored on the device.
4. Do not count on signatures alone. If you use the Threat Prevention signatures as a stopgap, confirm management traffic actually passes through a port where they apply, and alert on any management login from an unexpected address.

With 500+ assessments across critical infrastructure, the Red Tiger Security team helps owners review firewall management access and remote access paths into OT with plant-safe methods.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources:
Palo Alto Networks, "Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products," security advisory CVE-2026-109618, published 21 October 2026, updated 29 October 2026: https://security.paloaltonetworks.com/CVE-2026-109618
CISA Known Exploited Vulnerabilities catalog (CVE-2026-109618, CVE-2026-109619 and CVE-2026-46300): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
The Hacker News, "Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces," 29 October 2026: https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html
Dream Research, 26 October 2026: https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers

‍