{"id":3856,"date":"2026-10-29T08:28:53","date_gmt":"2026-10-29T08:28:53","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3856"},"modified":"2026-10-29T08:28:53","modified_gmt":"2026-10-29T08:28:53","slug":"attackers-exploit-php2shell-flaws-in-internet-exposed-palo-alto-networks-management-interfaces","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3856","title":{"rendered":"Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Oct 29, 2026<\/span><\/span>Vulnerability \/ Network Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Palo Alto Networks on Wednesday warned<\/a> that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces.<\/p>\n

\u00abActive exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet,\u00bb the network security company said in an update to its advisory.<\/p>\n

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), allow attackers to achieve unauthenticated remote code execution on systems running affected versions of PHP. The issues were patched upstream by the PHP Foundation on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.<\/p>\n

The development comes days after Israeli cybersecurity company Dream said it observed a suspected China-nexus threat actor weaponizing the flaws in conjunction with a local privilege escalation bug in the Linux kernel, tracked as Fragnesia (CVE-2026-46300, CVSS score: 7.8), to root 25 servers across the U.S., Japan, Taiwan, and South Korea.<\/p>\n

Among those were three systems belonging to a U.S. government-affiliated environment.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abThe affected devices run specific versions of a large vendor’s firewall software,\u00bb Dream noted. \u00abThe attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration.\u00bb<\/p>\n

<\/p>\n

Although Dream did not disclose the name of the affected firewall vendor, the timing of the advisory, combined with the fact that other<\/a> network security companies<\/a> have not reported malicious exploitation against their products, suggests that these events may be related.<\/p>\n

The Hacker News has contacted both Dream and Palo Alto Networks for comment, and we will update the story if we hear back.<\/p>\n

The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add<\/a> CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV<\/a>) catalog, requiring federal agencies to apply the fixes by October 31, 2026.<\/p>\n

\u00abThis vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP web shells and run commands as root,\u00bb CISA said.<\/p>\n

Palo Alto Networks has also noted that no special configuration is required to be affected by this issue, adding the risk is highest on PAN-OS when access to the management interface is allowed from external IP addresses on the internet.<\/p>\n

\u00abThis issue strictly affects the management web interface, which includes the HTTPS web UI and XML API service,\u00bb it said. \u00abIt affects the dataplane interface only if a management profile is attached to it.\u00bb<\/p>\n

The following versions of PAN-OS are impacted by PHP2Shell –<\/p>\n