NewsPublished 30 Oct 2026

PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Source SecurityWeek

Mentions 2 CVEs

Mentioned vulnerabilities

Description

The PHP2Shell vulnerability involves critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that have been actively exploited for over a week. Attackers, notably a China-linked group, have successfully chained these PHP2Shell flaws with the Fragnesia Linux kernel privilege escalation bug to gain root access on Palo Alto Networks PAN-OS firewalls. Despite over 22.6 million exposed PHP instances potentially vulnerable, successful exploitation has been limited, with WordPress sites remaining largely unaffected. Palo Alto Networks has released patches for multiple PAN-OS versions and urges customers to restrict internet access to management interfaces. The attacks appear opportunistic and originate from a small number of IP addresses, targeting various sectors including healthcare and technology.

Impact

Successful exploitation of PHP2Shell combined with the Fragnesia kernel vulnerability allows attackers to gain root access on vulnerable Palo Alto Networks firewalls, potentially compromising network security and control. The vulnerability affects management interfaces exposed to the internet, though such exposure is rare (.02% of installations). While broad PHP2Shell exploitation attempts target millions of PHP instances, confirmed successful compromises remain limited, with no confirmed WordPress site compromises. The impact is significant for affected firewall devices due to root-level access, but less so for general PHP servers where exploitation success is low.

Defensive guidance

Palo Alto Networks has released official patches for PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2 addressing the PHP2Shell vulnerabilities. Customers should immediately apply these patches. Additionally, restricting internet access to the management interface is critical, as exploitation requires exposure of this interface. Palo Alto Networks has contacted affected customers with internet-facing management interfaces. For general PHP servers, updating PHP to patched versions is recommended to reduce risk. No special configuration is required to be vulnerable, so patching and access restrictions are the primary mitigations.

Summary

PHP2Shell refers to critical PHP vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. These flaws have been exploited in the wild, particularly against Palo Alto Networks PAN-OS firewalls, where attackers chained PHP2Shell exploits with the Fragnesia kernel privilege escalation vulnerability to deploy root-level webshells. Palo Alto Networks confirmed the attacks and released patches for PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2 across PA-Series, VM-Series firewalls, and Panorama devices. The management interface exposure to the internet is a key factor in exploitation risk. Although over 22.6 million PHP instances are exposed, exploitation attempts against WordPress and other CMS platforms have been largely unsuccessful, partly due to environmental factors affecting exploit reliability. Attack traffic is concentrated from a few IPs, with healthcare and technology sectors most targeted. Palo Alto Networks has contacted affected customers and continues investigation.

References

securityweek.com/php2shell-attacks-root-palo-alto-firewalls-but-fail-against-wordpress/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 30 Oct 2026, 15:32 UTC

Technical details

References

Community reviews

Related threats