PHP2Shell Flaws Exploit Palo Alto PAN-OS Firewall Interfaces

Palo Alto Networks has confirmed active exploitation of two critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) targeting publicly exposed PAN-OS management interfaces. The unauthenticated remote code execution flaws allow unauthorized attackers to chain local privilege escalation exploits and gain full root control over vulnerable firewall devices.

What Happened During the PHP2Shell Exploitation Wave?

Between October 28 and October 29, 2026, security researchers and Palo Alto Networks confirmed that threat actors were actively weaponizing two critical vulnerabilities in the underlying PHP core—collectively dubbed PHP2Shell. Tracked as CVE-2026-109618 and CVE-2026-109619, both flaws carry a critical CVSS v4.0 severity rating of 9.2.

The attack vector specifically targets internet-exposed PAN-OS management interfaces and XML API services. Attackers bypass authentication entirely to achieve initial remote code execution (RCE) and drop malicious web shells. Threat actors then chain these PHP flaws with a separate Linux kernel local privilege escalation vulnerability (tracked as Fragnesia / CVE-2026-46300). This exploit chain grants attackers full root-level control, allowing them to enumerate Active Directory structures, steal corporate credentials, and pivot deeper into enterprise networks.

Palo Alto Networks clarified that patched customers are not vulnerable to this campaign. According to vendor figures, approximately 0.02% of its global installed base of firewalls had public management interfaces exposed to the open internet, and affected organizations have been notified directly. Additionally, Unit 42 retracted a preliminary update from October 23, so security teams should rely solely on the latest advisories.

What Is a Firewall Management Interface Exploit?

A firewall acts as a protective digital shield between a private internal network and the public internet. To configure rules, update policies, or monitor traffic, network administrators use a web-based management interface or API.

Under industry best practices, this administrative interface should only be accessible from inside trusted internal networks or via encrypted VPN tunnels. However, when an administration portal is left directly exposed to the public internet, any remote user on Earth can attempt to connect to it. A management interface exploit occurs when severe software bugs inside that web portal allow an attacker to run malicious system commands without ever logging in with a valid username or password. Once an attacker breaks through the firewall's outer layer, they gain a powerful foothold inside the corporate perimeter.

Why Are CVE-2026-109618 and CVE-2026-109619 So Dangerous?

The severity of PHP2Shell lies in how memory corruption handling functions inside the core PHP engine:

• CVE-2026-109618: Triggered by out-of-memory (OOM) handling conditions during interrupted HTTP requests, leaving internal data structures partially initialized. Subsequent cleanup procedures treat invalid data as valid, opening the door for code execution.

• CVE-2026-109619: Caused by stale global state retention after fatal error handling, where memory is reused across consecutive process worker requests (use-after-free).

Because network appliances like firewalls run consistent, standardized software builds, attackers can craft a reliable, repeatable exploit chain targeting all exposed devices running the vulnerable PAN-OS software stack.

How Can IT and Security Teams Secure Firewalls Now?

Organizations must act swiftly to audit perimeter access and isolate administrative access from public exposure. Follow this security checklist immediately:

1. Disable Public Internet Access to Management Interfaces: Immediately block inbound traffic from 0.0.0.0/0 to your PAN-OS HTTPS web interface and XML API services. Ensure administrative logins are restricted to dedicated, isolated management VLANs or encrypted jump servers.

2. Apply Vendor Software Updates: Update all PAN-OS instances to the latest software release provided by Palo Alto Networks that contains emergency PHP core patches.

3. Audit Exposure via External Scans: Run external attack surface mapping tools to verify that no perimeter firewalls, secondary devices, or cloud instances accidentally expose management ports (such as TCP 443 or 8443) to the public internet.

4. Inspect Logs for Web Shell Indicators: Analyze web server access logs and endpoint activity on firewall devices for unusual outbound HTTPS connections, long POST requests, or unauthorized PHP files created in temporary directories.

5. Enforce Zero Trust Network Access (ZTNA): Ensure micro-segmentation policies limit east-west traffic from perimeter firewalls to critical infrastructure like Active Directory domain controllers.