Threat actors have targeted servers with PHP2Shell vulnerabilities for over a week, successfully compromising a few Palo Alto Networks firewalls.
The vulnerability or weakness
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-109618 | 9.2 | CRITICAL | Yes, added 2026-10-26 | 2026-10-29 |
| CVE-2026-109619 | 9.2 | CRITICAL | Yes, added 2026-10-26 | 2026-10-29 |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces (2026-10-29)
- China-Linked Hackers Exploit PHP2Shell to Root Firewalls (2026-10-28)
- Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw (2026-10-25)
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge (2026-10-23)
- What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers (2026-10-22)
Business impact
Organizations with internet-facing management interfaces on Palo Alto Networks firewalls are at risk of root access compromises, potentially leading to data breaches and operational disruptions.
Industries affected
The incident affects organizations across various sectors, particularly those using Palo Alto Networks firewalls for network security.
Users affected
Customers with internet-exposed Palo Alto Networks firewalls are advised to restrict access and apply patches to avoid root access compromises.
Build these skills
Watch the daily brief
Sources
- Palo Alto Networks firewalls compromised in chained attacks using PHP2Shell (Cybersecurity Dive)
- PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress (SecurityWeek)
