Palo Alto Firewalls Under Attack: Exposed Management Interfaces Targeted via PHP2Shell Flaws

Palo Alto Networks has updated its advisory to say it has seen active exploitation of the recently patched PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity score of 9.2 and let attackers run code remotely without logging in on systems running affected versions of PHP. The PHP Foundation released fixes on October 21, 2026. The company says no special configuration is needed to be affected, and the risk is highest on PAN-OS when the management interface can be reached from the internet.

The warning follows research from Israeli security firm Dream, which saw a suspected China-linked group combine these flaws with a Linux kernel privilege escalation bug called Fragnesia (CVE-2026-46300). Using this chain, the attacker gained full control of 25 servers across the U.S., Japan, Taiwan and South Korea, including three systems in a U.S. government-affiliated environment. Dream said the devices ran specific versions of a large vendor's firewall software, and the attacker then targeted Active Directory, with evidence of credential theft and directory enumeration. Dream did not name the vendor, but The Hacker News notes the timing suggests the events may be related.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Fragnesia to its Known Exploited Vulnerabilities catalog, with federal agencies required to apply fixes by October 31, 2026. CISA said the flaw can be chained with the PHP2Shell bugs to plant web shells and run commands as root. The Hacker News has asked Dream and Palo Alto Networks for comment.