Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
Hackers exploit critical PHP2Shell flaws in Palo Alto Networks PAN-OS management interfaces. Discover affected versions, CVEs, patches, and mitigation steps.
Attackers are exploiting critical PHP2Shell vulnerabilities in internet-exposed Palo Alto Networks PAN-OS management interfaces, putting organizations with publicly accessible firewall administration services at risk. Palo Alto Networks confirmed active exploitation in an update to its official security advisory.
The flaws—CVE-2026-109618 and CVE-2026-109619—each carry a CVSS v4.0 score of 9.2 (Critical). Under exploitable conditions, they can allow unauthenticated remote code execution (RCE). Organizations running affected PAN-OS versions should immediately restrict management access, check vendor-recommended patches, and investigate unusual administrative activity.
Key takeaways
- Active exploitation: Palo Alto Networks reports attacks targeting management interfaces exposed to the internet.
- Critical flaws: CVE-2026-109618 and CVE-2026-109619 are collectively referred to as PHP2Shell; each has a CVSS score of 9.2.
- Affected interface: PAN-OS HTTPS management web UI and XML API, including appropriately configured dataplane interfaces with a management profile.
- Affected products: PAN-OS on PA-Series and VM-Series firewalls and Panorama (virtual and M-Series), in vulnerable releases.
- Recommended response: Restrict administration to trusted internal IP addresses, apply the matching fixed PAN-OS release, and monitor for suspicious activity.
What happened? Palo Alto Networks confirms PHP2Shell exploitation
In October 2026, researchers disclosed two critical vulnerabilities involving error-handling and memory-management behavior in the PHP runtime. Upstream PHP patches were released on October 21, 2026, in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Because PAN-OS uses affected PHP functionality for parts of its management service, the issue also affects certain Palo Alto Networks deployments. On October 29, 2026, the vendor's advisory reported active exploitation against management interfaces accessible from the internet.
This exposure is significant. Firewall management systems are high-value administrative assets. An unauthorized foothold in a management service could expose sensitive information, disrupt operations, or facilitate attempts to compromise other infrastructure. These are possible consequences, not necessarily outcomes confirmed in every reported attack.
What is PHP2Shell?
PHP2Shell refers to two vulnerabilities in PHP that can lead to remote code execution when specific memory and exception-handling conditions are triggered. The weaknesses are in the underlying runtime, rather than simply in an individual website plugin or application feature.
CVE-2026-109618: Out-of-memory error-handling weakness
CVE-2026-109618 concerns improper handling of an out-of-memory condition. Under certain conditions, error recovery can leave request-related memory in an unsafe state, potentially enabling code execution through carefully manipulated input.
CVE-2026-109619: Unsafe freed-memory references
CVE-2026-109619 concerns memory-safety behavior during fatal error handling. References to freed memory can remain accessible under vulnerable conditions, opening the possibility of memory manipulation and code execution.
| Vulnerability | General weakness | CVSS v4.0 | Potential impact |
|---|---|---|---|
| CVE-2026-109618 | Improper out-of-memory error handling | 9.2 — Critical | Unauthenticated RCE |
| CVE-2026-109619 | Unsafe references to freed memory | 9.2 — Critical | Unauthenticated RCE |
Exploitation depends on technical and environmental prerequisites; not every exposed or unpatched deployment is necessarily compromised.
Which Palo Alto Networks products and interfaces are affected?
Palo Alto Networks lists affected releases in the following supported PAN-OS branches:
- PAN-OS 12.2
- PAN-OS 12.1
- PAN-OS 11.2
- PAN-OS 11.1
- PAN-OS 10.2
The advisory applies to PAN-OS installed on PA-Series and VM-Series firewalls, as well as Panorama virtual and M-Series appliances. Exact vulnerable builds and fixed versions vary by maintenance branch.
PAN-OS fixed-version targets
The following are examples of fixed builds listed in the vendor advisory. Not all releases necessarily had the same availability on October 29, 2026. Verify the exact recommended upgrade and whether it has been published before making changes.
| PAN-OS branch | Vendor-listed fixed-build examples |
|---|---|
| 12.2 | 12.2.4-h1 |
| 12.1 | 12.1.4-h13, 12.1.7-h11, 12.1.10-h3 |
| 11.2 | 11.2.4-h23, 11.2.7-h23, 11.2.10-h16, 11.2.13-h4, 11.2.16-h1 |
| 11.1 | 11.1.4-h38, 11.1.6-h40, 11.1.7-h12, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4 |
| 10.2 | 10.2.7-h39, 10.2.10-h42, 10.2.13-h27, 10.2.16-h12, 10.2.18-h13 |
The vulnerable attack surface is the management web interface, including its HTTPS web UI and XML API. A dataplane interface is affected in this context when an applicable management profile is attached.
The vendor says GlobalProtect portal, GlobalProtect gateway, GlobalProtect Clientless VPN, and Captive Portal are not affected by this specific issue.
Check the Palo Alto Networks advisory for release-specific version mapping and updated remediation instructions.
How are attackers targeting exposed management interfaces?
Attackers can identify reachable administrative endpoints on public IP addresses and attempt to interact with susceptible services. PHP2Shell's underlying memory issues may be triggered through maliciously crafted requests under the necessary conditions.
A potential attack sequence includes:
- Exposure discovery: Finding firewall administration services reachable from the internet.
- Version and surface assessment: Identifying installations likely to contain the vulnerable PHP runtime.
- Exploit attempts: Sending requests intended to trigger unsafe PHP error-handling behavior.
- Potential code execution: Attempting unauthorized commands in the security context of the affected service.
- Possible follow-on activity: Attempting reconnaissance, data access, persistence, or lateral movement if initial access succeeds.
These steps describe the general risk pathway; they are not a confirmed sequence for every attack. Palo Alto Networks has confirmed exploitation targeting exposed interfaces, but public reports do not establish that all attempted attacks succeeded.
Why internet-exposed firewall management is dangerous
Firewall management services can expose configuration controls, access policies, and operational data. Allowing arbitrary internet hosts to reach those administrative services unnecessarily enlarges the attack surface.
A management-interface compromise could create opportunities for:
- Unauthorized access to settings and sensitive administrative information.
- Changes that weaken the security posture of a network.
- Disruption of management workflows or appliance operations.
- Additional attacks against connected systems, depending on attacker privileges and network architecture.
Even after the PHP2Shell patches are installed, management-plane isolation remains a valuable defense against future vulnerabilities.
How to mitigate PHP2Shell risks in PAN-OS
1. Identify publicly reachable management services
Inventory PA-Series, VM-Series, and Panorama deployments. Check which dedicated management interfaces and management-enabled dataplane interfaces are reachable from outside trusted administrative networks. Prioritize publicly accessible assets.
2. Restrict administrative access
Palo Alto Networks recommends limiting management connectivity to trusted internal IP addresses. When remote access is necessary, use an appropriately secured jump host or tightly controlled administrative network. Avoid exposing HTTPS management and XML API access to the open internet.
3. Apply vendor-supported PAN-OS hotfixes
Confirm the exact software maintenance branch, identify the correct fixed build, and follow the official upgrade procedure. Validate backups, compatibility, and appliance health around the change.
Do not attempt to fix PAN-OS by manually installing upstream PHP packages. Use Palo Alto Networks' supported firmware releases and guidance.
4. Evaluate threat prevention protections
Palo Alto Networks identifies Threat ID 543004 and additional signatures in relevant Applications and Threats content updates. The vendor notes that the protections require appropriate traffic inspection architecture. Depending on the configuration, that can include routing management traffic through a dataplane interface, replacing the relevant inbound-management certificate, enabling inbound decryption, and applying Threat Prevention.
Follow the vendor's detailed instructions rather than assuming a signature alone provides complete coverage.
5. Hunt for suspicious activity
Review relevant logs and telemetry for unusual management requests, unexpected source IPs, suspicious processes, unexplained outbound connections, unauthorized configuration changes, and anomalous administrative actions.
No single signal establishes successful exploitation. Correlate multiple data sources and preserve forensic evidence if compromise is suspected.
6. Respond to potential compromise
If there are signs of successful exploitation, involve the incident response team and follow vendor-supported containment and recovery procedures. Depending on the evidence, actions may include credential rotation, configuration verification, appliance recovery, and investigation of connected infrastructure.
Installing a patch does not necessarily remove an attacker who already gained persistence.
PHP2Shell timeline: October 2026
| Date | Development |
|---|---|
| October 20, 2026 | Details about critical PHP runtime vulnerabilities surfaced ahead of coordinated disclosure. |
| October 21, 2026 | Upstream PHP security updates were released. |
| October 23, 2026 | Palo Alto Networks published further research and defensive guidance. |
| October 27, 2026 | Palo Alto Networks raised the PAN-OS advisory severity to Critical. |
| October 29, 2026 | Palo Alto Networks reported active exploitation of internet-exposed management interfaces. |
Because this story is developing, administrators should rely on live vendor advisories for the newest fixes and exploitation details.
What the attacks mean for enterprise security teams
PHP2Shell illustrates a common enterprise security challenge: a vulnerability in a shared software component can affect high-value products that incorporate it. A perimeter security device is not immune from threats to its own administrative software.
Organizations should maintain accurate inventories of internet-facing services, isolate management networks, deploy security fixes promptly, and monitor management infrastructure with the same care given to business-critical servers.
The most effective response combines attack-surface reduction, patching, monitoring, and a tested incident response plan.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the name used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that may allow unauthenticated remote code execution under exploitable conditions.
Are attackers actively exploiting PHP2Shell in Palo Alto Networks firewalls?
Yes. Palo Alto Networks reported active exploitation targeting management interfaces accessible from the internet in its October 29, 2026 advisory.
Which PAN-OS versions are affected?
The advisory lists affected releases across PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2. The precise fixed build depends on the installed branch and maintenance version.
Does PHP2Shell affect GlobalProtect VPN?
The vendor states that GlobalProtect portal, gateway, and Clientless VPN are not affected by this specific issue.
Can PHP2Shell be exploited without logging in?
The underlying vulnerabilities may permit unauthenticated remote code execution when the necessary exploit conditions are met.
What should organizations do first?
Restrict management access to trusted internal IP addresses, identify affected PAN-OS installations, apply the applicable vendor updates, and review logs for suspicious activity.
Is a firewall safe if its management interface is not internet-exposed?
Removing public exposure substantially reduces risk from internet-based attackers, but affected software may remain vulnerable to threats from compromised or trusted networks. Apply the appropriate fix regardless of current exposure.
Conclusion
Active exploitation of PHP2Shell flaws against internet-exposed Palo Alto Networks management interfaces is a reminder that security appliances need robust protection of their own administrative services. With CVE-2026-109618 and CVE-2026-109619 rated Critical, organizations should prioritize management-interface restrictions, targeted patching, and investigation of possible compromise.
The central lesson is straightforward: keep administrative surfaces private, maintain supported software versions, and monitor critical security infrastructure continuously.