Palo Alto Networks PAN-OS: PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploited through internet-exposed management interfaces

What happened

PHP2Shell is a pair of PHP engine flaws, CVE-2026-109618 and CVE-2026-109619, fixed by PHP on 21 October 2026 (see our PHP2Shell advisory). PAN-OS uses PHP in its management web interface, so Palo Alto Networks published its own advisory the same day (Palo Alto Networks).

• Affected: PAN-OS on PA-Series and VM-Series firewalls, and Panorama (virtual and M-Series). The affected component is the management web interface: the HTTPS web UI and the XML API. A dataplane interface is affected only if a management profile is attached to it.
• Not affected: GlobalProtect portal, gateway and Clientless VPN, Captive Portal, Cloud NGFW and Prisma Access.
• Severity: Critical, CVSS 4.0 9.2, exploit maturity “ATTACKED”, when management is reachable from the internet. With management restricted to a jump box it drops to 5.2 (Medium). No special configuration is needed to be affected.

Palo Alto raised the advisory to Critical on 27 October and rolled hotfixes out from 25 to 29 October (Palo Alto Networks). The advisory now states: “Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.” Palo Alto told The Hacker News that under 0.01% of its installed base has internet-facing management, and that it contacted each potentially affected customer (The Hacker News).

The Fragnesia chain. Israeli security firm Dream reported a suspected China-nexus actor chaining PHP2Shell with CVE-2026-46300 (“Fragnesia”), a Linux kernel privilege escalation. It rooted 25 servers in the US, Japan, Taiwan and South Korea, three of them in a US government-affiliated environment. The actor then moved to Active Directory, with credential extraction and directory enumeration found in recovered artifacts. Dream did not name the firewall vendor. The Hacker News links the activity to Palo Alto by timing, and Dream later said it is working with Palo Alto. Dream says the actor obtained PAN-OS firmware and built memory profiles for nine software versions (The Hacker News).

CISA added both PHP CVEs to the KEV catalog on 26 October and CVE-2026-46300 on 28 October. The KEV entry for CVE-2026-46300 says it “can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root” (CISA KEV; CISA).

Am I affected?

Every supported PAN-OS train before its fixed hotfix is affected, from 10.2 to 12.2. Older, unsupported releases are affected with no fix; Palo Alto says to upgrade to a supported fixed version. Your risk is highest if the management interface accepts connections from internet addresses (Palo Alto Networks).

Each range includes hotfix builds below the fixed one: for example, 12.2.4 itself is affected and 12.2.4-h1 is fixed.

From the firewall or Panorama CLI:

# Software and content versions
show system info | match sw-version
show system info | match threat-version

# In configuration mode: who may reach the management port
configure
show deviceconfig system permitted-ip
# Interface management profiles that expose the web UI on dataplane interfaces
show network profiles interface-management-profile

An empty permitted-ip list means any address that can route to the management port can reach it. Any management profile with HTTPS enabled on an internet-facing interface puts the web UI on the internet.

Palo Alto says it contacted each potentially affected customer directly. If you received that notice, treat your device as exposed (The Hacker News).

What to do now

1. Install the fixed hotfix for your train from the table above. On 11.2.10, prefer 11.2.10-h17, which also fixes a separate brotli issue; 11.2.10-h16 has only the PHP fix (Palo Alto Networks).
2. Take management off the internet. Allow the management interface only from a jump box or trusted internal IPs, and remove management profiles from internet-facing interfaces (Palo Alto Networks).
3. If you cannot patch yet, turn on the signatures. Enable Threat ID 543004 and the 97xxx Threat IDs listed in the advisory, with Applications and Threats content 9162 or later. The advisory also suggests routing management traffic through a dataplane port, replacing the inbound management certificate, decrypting inbound management traffic and applying threat prevention to it (Palo Alto Networks).
4. Investigate any device that was exposed. Palo Alto has published no indicators of compromise. Based on Dream’s report, look beyond the firewall: check Active Directory for queries and logins that originate from firewall or Panorama management addresses, and review admin accounts and configuration changes on the device (The Hacker News).
5. Patch the Linux kernel on other PHP servers. CVE-2026-46300 turns a PHP2Shell foothold into root on any Linux host. CISA’s KEV entry lists the stable kernel fixes (CISA KEV).

Sources

• Palo Alto Networks: CVE-2026-109618, impact of PHP2Shell on Palo Alto Networks products
• The Hacker News: attackers exploit PHP2Shell flaws in firewalls
• CISA: two known exploited vulnerabilities added to catalog (28 October 2026)
• CISA Known Exploited Vulnerabilities catalog