PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

What it is

PHP2Shell is a pair of PHP flaws, CVE-2026-109618 and CVE-2026-109619, under mass exploitation attempts for over a week as of 30 October 2026. Palo Alto Networks (PAN-OS) firewalls are the confirmed high-impact target. Dream Research found at least 25 firewalls, out of a pool of hundreds, rooted by a China-linked group. Palo Alto Networks and its Unit 42 team have verified the tooling and results.

How it works

The attackers, assisted by AI according to the page, used two chained exploits. One targets the PHP2Shell flaws on the PAN-OS management interface. The other uses the Fragnesia Linux kernel privilege escalation bug to deploy webshells with root privileges. The page gives no further technical detail on either bug.

flowchart LR
    A[Internet-exposed PAN-OS management interface] --> B[PHP2Shell exploit]
    B --> C[Fragnesia privilege escalation]
    C --> D[Root webshell]
    E[Restrict management access, patch] -. cuts chain .-> A

Preconditions / Affected

Palo Alto Networks says no special configuration is needed to be affected, but active exploitation targeted management interfaces exposed to the internet. By default the management interface is not exposed. The company puts the impacted share at about 0.02% of its global installed base, and says each affected customer was contacted individually.

Fixed lines are PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2, for PA-Series and VM-Series firewalls and for Panorama (virtual and M-Series). The page does not list fixed build numbers.

Palo Alto Networks telemetry as of 29 October 2026 shows over 22.6 million exposed PHP instances that are potentially vulnerable. This covers WordPress, Drupal, Joomla and others.

What to do

• Restrict access to the PAN-OS management interface immediately, as Palo Alto Networks urges.
• Apply the PAN-OS patches for your release line.
• Update PHP on other servers. Defiant warns that a successful attack could expose site files, the database and passwords.

Caveats

• WordPress: as of 28 October 2026 Defiant knew of no site compromised via PHP2Shell, despite over 77,000 requests from more than 2,000 IP addresses. Defiant says exploits often need tuning for ASLR, PHP build, running extensions, memory limits and request handling, and that attackers are still changing their tools.
• Cato Networks: about 96% of the attacks it blocked targeted CVE-2026-109618, and 41% of those attempted RCE. The rest were scanning or invalid PoC attempts. They came from a handful of IPs in the US, the Netherlands and Germany. Cato calls the activity opportunistic, with healthcare the most targeted sector.
• watchTowr has seen successful exploitation from a single German IP. It runs a curl command as proof and does nothing further. Jake Knott, watchTowr head of threat intelligence, expects public reports of targeted successful attacks on specific edge appliances to keep growing.
• The page names no indicators of compromise or detection queries.