PHP2Shell is a vulnerability stemming from two critical PHP memory-safety flaws (CVE-2026-109618 and CVE-2026-109619) patched in October 2026. Exploit development is widespread, with over 600 related files found in open directories. While exploitation was only successful on honeypots in the open internet, attackers have weaponized PHP2Shell combined with a Linux kernel privilege escalation (CVE-2026-46300) to gain root access on 25 Palo Alto PAN-OS firewalls. The campaign used AI-driven reconnaissance to identify and target 240 high-value firewalls from about 19,000 internet-facing devices. Multiple attacker clusters share exploit toolkits and infrastructure, targeting government, banking, and telecom sectors.
