PHP2Shell One Week Later: Honeypot Shells on the Web, a Path to Root on Palo Alto Firewalls

PHP2Shell is a vulnerability stemming from two critical PHP memory-safety flaws (CVE-2026-109618 and CVE-2026-109619) patched in October 2026. Exploit development is widespread, with over 600 related files found in open directories. While exploitation was only successful on honeypots in the open internet, attackers have weaponized PHP2Shell combined with a Linux kernel privilege escalation (CVE-2026-46300) to gain root access on 25 Palo Alto PAN-OS firewalls. The campaign used AI-driven reconnaissance to identify and target 240 high-value firewalls from about 19,000 internet-facing devices. Multiple attacker clusters share exploit toolkits and infrastructure, targeting government, banking, and telecom sectors.

• PHP · PHP2Shell (CVE-2026-109618/9) Havoc: UNC actors leveraging Public Exploit Code Against Public, Business And Educational InfrastructureExploitedVulnerability2026-10-27
• several Festo Didactic products · Two Critical PHP VulnerabilitiesExploitedVulnerability2026-11-02
• WAGO: Multiple Devices affected by PHP2ShellExploitedVulnerability2026-11-02
• Red Hat Bug Fix Advisory: OpenShift Container Platform 4.21.17 packages updateExploitedVulnerability2026-05-26
• SUSE · security update for phpExploitedVulnerability2026-10-26