Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces

Key Points:

• Palo Alto Networks has reported active exploitation of recently patched PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) targeting publicly accessible management interfaces, allowing unauthenticated remote code execution.
• Israeli cybersecurity firm Dream linked these exploits to a suspected China-based threat actor who combined PHP2Shell flaws with a Linux kernel privilege escalation bug (CVE-2026-46300) to compromise 25 servers globally, including U.S. government-affiliated systems.
• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog, mandating federal agencies patch the issue by October 31, 2026, due to its potential to enable root-level command execution when chained with PHP2Shell vulnerabilities.
• Palo Alto Networks emphasized that no special configuration is needed for exploitation, with highest risk when management interfaces are accessible from external IPs, and provided a detailed list of affected PAN-OS versions along with patch availability and interim mitigation measures.
• Recommended mitigations include restricting management interface access to trusted IPs, routing management traffic through dataplane ports, replacing inbound certificates, decrypting inbound traffic for inspection, and enabling threat prevention, with advance protection available via Frontier Virtual Patching on newer PAN-OS versions.