PHP2Shell Now Hitting Palo Alto Firewalls: Act Now

If you look after a Palo Alto Networks firewall, today is a good day to check who can reach its management page. Palo Alto has updated its PHP2Shell advisory to say attackers are now actively going after PAN-OS management interfaces that are open to the internet, and several of the fixed builds aren't out yet.

What happened

PHP2Shell is the nickname for two critical PHP bugs, CVE-2026-109618 and CVE-2026-109619. Both let an attacker run code without logging in, by abusing how PHP cleans up after out-of-memory and fatal errors. The PHP project patched them on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and PHP has since flagged a separate RCE issue as well.

PAN-OS uses PHP behind its web admin console, so Palo Alto's own products inherited the problem. Its security advisory, updated on 29 October, now reads: "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet." The company rates it 9.2 out of 10. The exposure is the HTTPS web UI and the XML API, and a dataplane interface only counts if it has a management profile attached.

The Hacker News flagged the update on X and has a full list of affected builds. Palo Alto hasn't said who is behind the attacks or how many devices have been hit.

Why it matters

A firewall is the one box that's supposed to keep attackers out. If someone can run code on its admin plane, they can change rules, read configs and sit inside the network quietly. Palo Alto gear has been a favourite target for exactly this reason, and management pages exposed to the internet have been the weak spot more than once.

The awkward part is timing. PAN-OS 12.2.4-h1 is available now, but some branches, including a few 12.1, 11.2, 11.1 and 10.2 builds, had fixes listed as due on 29 or 30 October. Some admins are going to be waiting a day or two on a bug that's already being exploited.

What to do

• Lock down the management interface first. Only trusted internal IPs, or a single jump box, should be able to reach it. That one change cuts off the attack path being used right now.
• Patch to the fixed hotfix for your branch as soon as it's listed in the advisory. 12.2 users can move to 12.2.4-h1 today.
• If your fix isn't out yet, follow Palo Alto's interim steps: route management traffic through a dataplane port with Threat Prevention turned on and decryption for inbound management traffic. The Unit 42 threat brief lists the threat IDs.
• Check for signs of compromise if your admin page was reachable from the internet in the last week: unexpected admin accounts, config changes and odd outbound connections.

Running PHP on your own servers? Make sure you're on one of the 21 October releases too. Palo Alto is just the biggest name to get caught by this so far.