PHP2Shell Exploit Roots Palo Alto Firewalls as Attackers Chain a Kernel Bug

Ten days after emergency PHP patches landed, the first clearly confirmed organizational compromises tied to PHP2Shell did not come from a forgotten blog. They came from firewalls.

Security researchers and Palo Alto Networks say a suspected China-linked operator chained the critical PHP flaws with a Linux kernel privilege-escalation bug to gain root on PAN-OS devices whose management interfaces were reachable from the internet. The campaign, documented by Israeli firm Dream and independently verified by Palo Alto’s Unit 42, hit systems in the United States, Japan, Taiwan, and South Korea, including equipment tied to a U.S. government-affiliated environment.

The episode is a sharp reminder that edge appliances are still servers with a management plane. When that plane runs vulnerable code and faces the public internet, a language bug becomes a network-control problem. Patches are now out. Cleanup is not optional.

What PHP2Shell actually is

PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619, a pair of memory-safety flaws in the PHP interpreter itself. The PHP project scores both 9.2 on CVSS v4.0. An unauthenticated attacker who can send web requests to a vulnerable PHP installation may be able to run code on the host. The bugs reach across years of PHP releases, from the 5.4 line through unpatched 8.5 builds, which is why early estimates suggested a huge share of the web could be in scope.

Researchers at Calif, working with OpenAI, and at Wiz found the issues in August 2026, with substantial help from large language models. Details leaked ahead of a planned disclosure. PHP shipped emergency fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The U.S. Cybersecurity and Infrastructure Security Agency added both CVEs to its Known Exploited Vulnerabilities catalog on October 26.

The architectural point matters more than the nickname. This is not a WordPress plugin bug or a framework misconfiguration. The flaw lives in PHP. Any product that bundles its own PHP runtime inherits it until the vendor ships a fix. Palo Alto Networks’ PAN-OS is one of those products. Its management web interface, including the HTTPS admin UI and the XML API, runs PHP. No special feature has to be turned on for a reachable management interface to be affected. GlobalProtect portals, gateways, and Clientless VPN are not part of this issue, and a dataplane interface is in scope only if a management profile is attached.

How the firewall campaign worked

Dream reported that one operator treated PAN-OS as a high-value, relatively uniform target. From a large set of internet-facing firewalls — on the order of 19,000 devices located through internet-asset search — the actor narrowed the list by geography and software profile to a few hundred systems in the United States, Japan, Taiwan, and South Korea. Attacks were underway by October 23.

PHP2Shell alone was not the whole story. The operator chained it with Fragnesia, CVE-2026-46300, a Linux kernel privilege-escalation flaw disclosed in May and later added to CISA’s KEV catalog, with a federal remediation deadline of October 31. Reporting describes a custom chain that moved from an unauthenticated request against the management interface to a persistent root-level webshell in under 15 minutes. Dream said 25 servers were rooted in total: firewalls plus, in at least one case, an internal management server reached after the initial breach.

Follow-on activity went well beyond parking a shell. In the U.S. government-affiliated case, researchers say the attacker tunneled into the internal network within hours, decrypted a stored LDAP service-account password, enumerated Active Directory, and attempted further credential attacks. Palo Alto Networks confirmed active exploitation against internet-exposed management interfaces and said Unit 42 verified the attacker’s tooling and the reported results. The company put the share of its global installed base that both exposed management to the internet and was impacted at roughly 0.02 percent, and said it had contacted those customers individually.

Attribution remains cautious. Dream points to China-nexus indicators, including use of a Chinese asset-search platform, UTC+8 timestamps, and Chinese-language prompts in tooling, and describes the work as AI-assisted research against PAN-OS firmware. It has not named a specific group. What is not in dispute is the outcome: root on security appliances that sit on the path of enterprise traffic.

A huge scan wave, a narrow set of wins

The firewall hits stand out because the broader PHP2Shell wave has been loud and, so far, less successful than the initial panic suggested.

Palo Alto’s Cortex Xpanse telemetry had identified more than 22.6 million internet-exposed PHP instances potentially vulnerable as of October 29. Defenders have watched a steady drumbeat of scans and exploit attempts since the October 21 patches. Wordfence, which protects more than five million WordPress sites, said that as of October 28 it knew of no WordPress compromise attributed to PHP2Shell, even after logging roughly 77,600 related requests from more than 2,000 IP addresses between October 23 and 27. The firm was explicit that a lack of confirmed hits is not a reason to skip the patch. Reliable exploitation often has to be tuned to a specific PHP build, memory limits, and how the server handles requests. Identical appliances are an easier problem than the long tail of uniquely configured websites.

Cato Networks, looking at attempts it blocked, said about 96 percent targeted CVE-2026-109618 and that roughly 41 percent tried remote code execution, with the rest looking like scanning or broken proof-of-concept traffic. Sources clustered in a handful of addresses in the United States, the Netherlands, and Germany. Healthcare organizations saw the most attempts, followed by technology and other sectors, but the pattern looked opportunistic rather than one tailored campaign. WatchTowr separately described successful exploitation from one German address that stopped after a simple connectivity check, with no further post-exploitation.

That split — mass noise against websites, precise success against a uniform firewall image — is the lesson security teams should take into the next language-level bug.

What defenders should do now

Palo Alto Networks has released hotfixes across the affected PAN-OS branches — 12.2, 12.1, 11.2, 11.1, and 10.2 — for PA-Series and VM-Series firewalls and for Panorama. By October 30, fixes were reported as available for every supported maintenance line the advisory had listed. Match the exact hotfix to your release train in the vendor advisory. A nearby minor version is not automatically the fix. Updating PHP on a website does nothing for the copy of PHP embedded in PAN-OS.

Priority order for firewall owners:

• If the management interface is reachable from the internet, take it off the public internet immediately. Palo Alto’s guidance is that management should be limited to trusted internal addresses. That control cuts off the path used in the confirmed attacks even before a maintenance window.
• Install the PAN-OS hotfix for your branch. Unit 42 says the fixes interrupt the observed exploit chain. Do not try to replace the appliance’s PHP libraries by hand.
• Treat any internet-exposed, unpatched management interface that was online between the October 21 disclosure and your patch as potentially compromised. Patching does not remove a webshell, a tunnel, or stolen credentials.
• Hunt for follow-on activity: unexpected administrative access, new persistent remote access, anomalous outbound connections from the firewall, and Active Directory events that line up with the intrusion window. Rotate credentials that lived on or were reachable from the device, including directory service accounts.
• Preserve logs before you rebuild. Incident response on an edge device is only useful if you can see whether the attacker pivoted inward.

For everyone else running PHP, the same urgency applies at a different layer. Move to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or to a vendor package that explicitly includes both fixes, and restart PHP workers so the old code is actually gone. Updating WordPress, Drupal, or a plugin does not update the interpreter. PHP 8.1 and older have no official upstream fix. Those stacks need a vendor backport or a migration plan. End-of-life runtimes are where this class of bug lingers.

Compliance teams should map the CISA KEV entries. Both PHP flaws have been listed as known exploited since October 26, and Fragnesia carried a federal patch deadline of October 31. If you are a federal agency or a contractor measured against KEV timelines, document the decision, the build you installed, and the exposure review — not just the ticket number.

The management plane was never supposed to be a website

PHP2Shell was billed, briefly, as a threat to most of the web. The confirmed damage so far has been narrower and, in some ways, more serious: root on the boxes organizations trust to enforce policy, including systems adjacent to a U.S. government-affiliated network. Mass exploitation of ordinary sites has not shown up in the telemetry major WordPress defenders are willing to stand behind. That can change as exploit reliability improves, especially against appliances that all ship the same PHP build.

The practical standard is no longer “we will patch PHP when the host gets around to it.” Management planes do not face the internet. Vendor hotfixes for bundled runtimes ship on an emergency clock. Any device that missed that clock gets an intrusion review, not a shrug. The patches are out. The open question is whether the management interface was ever supposed to be a public website in the first place.