Attackers have used the critical PHP2Shell vulnerabilities to gain root access to internet-exposed Palo Alto Networks firewalls, while probes against WordPress sites have so far produced no confirmed compromises. Palo Alto Networks’ Unit 42 said the campaign chained CVE-2026-109618 and CVE-2026-109619 with a separate Linux kernel privilege-escalation flaw to compromise PAN-OS management interfaces. [17]
PHP2Shell describes two unauthenticated remote-code-execution bugs in PHP. The first, CVE-2026-109618, can leave request memory uninitialized when PHP handles an out-of-memory condition; the second, CVE-2026-109619, can leave global state pointing to freed memory. The PHP Foundation’s security release says both conditions can be turned into code execution in vulnerable server configurations, including Apache with mod_php. [22]
Unit 42 rates the pair 9.2 under CVSS 4.0, placing them in the critical category; the NVD record for CVE-2026-109618 documents the underlying memory-handling weakness. [16][17] Palo Alto’s product advisory lists PAN-OS and Panorama exposure across the 10.2, 11.1, 11.2, 12.1 and 12.2 release branches. [18] The vendor has issued fixes across those branches and says customers should install the applicable PAN-OS update rather than rely solely on detection controls.
Dream Research reported that a suspected China-linked operation developed a custom exploit chain against exposed PAN-OS management servers. Unit 42 independently verified the tooling and the reported results, including root access on 25 servers, but its advisory does not provide a formally confirmed threat-group name. The campaign affected only a small fraction of Palo Alto’s installed base because management interfaces are normally intended to remain off the public internet. [17]
The broader exposure remains substantial: Palo Alto said Cortex Xpanse telemetry identified more than 22.6 million publicly exposed PHP instances that could be vulnerable, a figure that represents potential exposure rather than confirmed compromise. WordPress sites were also scanned: researchers recorded more than 77,000 related requests from over 2,000 IP addresses, but Palo Alto said it had not identified a WordPress compromise through PHP2Shell as of October 28. [3]
PHP administrators should upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, the versions CISA identifies as fixing the vulnerabilities. [20] Firewall operators should immediately remove public access to PAN-OS and Panorama management interfaces, restrict administration to trusted addresses, apply Palo Alto’s relevant security update and investigate logs for unexpected PHP-driven process execution or post-exploitation activity. Organizations that exposed management services should also treat the systems as potentially compromised and conduct an incident-response review.
References
- PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
- NVD-CVE-2026-109618 – NIST
- CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE …
- AL26-026 – Critical vulnerabilities impacting PHP – CVE-2026-109618 and CVE-2026-109619 – Canadian Centre for Cyber Security
- NCSC Advisory
- Vulnerabilities in PHP Affecting Cisco Products
