# PHP2Shell Flaws Are Under Attack, Including Palo Alto Firewall Interfaces

- URL: https://usa-24.com/php2shell-exploits-palo-alto-firewalls/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-11-07T03:25:35.056Z
- Updated: 2026-11-07T03:25:35.065Z
- Topics: PHP2Shell, Palo Alto Networks, CISA, Vulnerability Exploitation, Firewall Security, Web Server Security

> Attackers are exploiting two critical PHP flaws against internet-exposed Palo Alto Networks firewall management interfaces, and Singapore confirmed it on November 3.

## Key takeaways

- Singapore's Cyber Security Agency confirmed on November 3, 2026, that attackers are exploiting PHP2Shell against internet-exposed Palo Alto Networks firewall management interfaces.
- The PHP team fixed CVE-2026-109618 and CVE-2026-109619 on October 21, 2026, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Both flaws carry a CVSS v4.0 score of 9.2 and can let an unauthenticated attacker run code with the privileges of the PHP worker process.
- Amazon Threat Intelligence researchers said attackers began targeting the flaws four days before the security patches were released.
- One secondary report says updating WordPress will not fix the flaw, so administrators should check each server's PHP version directly.

## What Singapore's November 3 alert changed

On November 3, Singapore's Cyber Security Agency confirmed active exploitation of two critical PHP flaws, collectively known as PHP2Shell, against internet-exposed management interfaces of Palo Alto Networks firewalls, according to [CU Today](https://www.cutoday.info/THE-news/PHP2Shell-Threat-Escalates-As-Hackers-Target-Security-Systems-Gain-Deeper-Network-Access). The fixes shipped on October 21, so any server still running an older release has been exposed for more than two weeks.

Palo Alto's advisory update described the same activity. "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet," the network security company said, as [The Hacker News](https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html) reported.

A management interface controls the device itself. If an attacker runs code there, the device can become a foothold into the network behind it. That is why firewall operators treat exposed management panels as high-value targets. The flaws live in PHP, not in one vendor's hardware, so the exposure reaches any system that runs PHP on a public web server.

This is also the latest in a run of attacks on edge hardware. USA 24 has reported on [an active SonicWall SSLVPN exploit](https://usa-24.com/sonicwall-cve-2026-19868-sslvpn-exploit/) and [an Ivanti Connect Secure chain that gives attackers root on fully patched VPNs](https://usa-24.com/ivanti-connect-secure-vulnerability-root/). Devices at the network boundary are reachable from the internet and valuable once compromised.

## Which PHP versions fix PHP2Shell

The PHP development team released emergency security updates on October 21, 2026, to address CVE-2026-109618 and CVE-2026-109619. [Arctic Wolf Labs](https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/) says both flaws carry a CVSS v4.0 score of 9.2 and can let an unauthenticated attacker run code with the privileges of the PHP worker process.

The fixed releases reported across coverage are:

- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35

Run `php -v` on each server to see which branch and release is installed. If a server runs a branch that does not appear on this list, look up the fixed release for that branch in PHP's own advisory rather than assuming the nearest number is safe.

## Which servers face the highest risk

Any public web server running PHP is in scope. The configuration drawing the most concern is Apache with mod_php. A [DEV Community post](https://dev.to/ahtisham_lala_a1af953f29b/php2shell-the-critical-php-flaw-that-lets-attackers-run-code-on-your-wordpress-server-and-555i) says PHP singles out that setup as the highest-risk deployment and points to a demonstrated exploit for it. Because the post is a secondary write-up, confirm the ranking against PHP's advisory before acting on it.

The same post says "updating WordPress won't fix it." That matters for hosts that treat plugin and core updates as their main patch routine. The fix sits in PHP itself, so the PHP runtime must be updated on every affected server.

The reach is broad. CU Today reports that the Netherlands' National Cyber Security Centre is tracking 948 software products for potential PHP2Shell exposure. That count reflects products that may be affected, not confirmed compromises.

## How fast attackers moved and how many servers are exposed

Attackers did not wait for the patch cycle to finish. Amazon Threat Intelligence researchers said attackers began targeting the PHP2Shell flaws four days before the security patches were released, as [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/) reported. Microsoft also confirmed both flaws were being actively exploited and warned that attempts started before coordinated public disclosure, according to CU Today.

Proof-of-concept code spread quickly. [BleepingComputer](https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/) reports that both flaws have been successfully exploited in the wild. After confirming remote code execution on honeypots, Adel Karimi, detection and response lead at Perplexity, said, "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process," according to [The Hacker News](https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html).

Two scale figures are circulating, and both need caution. A DEV Community post citing Censys data says about 29 million servers were still unpatched two weeks after the fix. That figure comes from a secondary blog, so check Censys directly before repeating it. Separately, a third-party blog report says one operator claimed 581 compromised hosts. That claim is unverified, and no public count of compromised firewalls or servers appears in the reporting reviewed for this story.

A separate PHP flaw, CVE-2026-115560, had no patch at the last report, according to BleepingComputer. Track it while you patch the PHP2Shell CVEs.

## CISA deadlines and conflicting reports

CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 26 and urged organizations to treat them as an urgent patching priority, according to [Cybersecurity News](https://cybersecuritynews.com/php2shell-vulnerabilities-actively-exploited/). That report says federal civilian agencies had to mitigate by October 29 under BOD 26-04.

Reporting on the deadline does not agree. The Hacker News described an October 31 deadline tied to a different Palo Alto flaw, CVE-2026-46300. The Palo Alto advisory and CISA's catalog entries were not reviewed directly for this article, so every claim here rests on secondary reporting. Before you cite a due date, open CISA's catalog and read the entries yourself.

## How to check and patch your PHP servers

Start with an inventory and work through these steps:

- List every host that runs PHP, including servers you did not set up yourself and internet-facing staging systems.
- Run `php -v` and compare the result with the fixed releases: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- Patch PHP itself, then restart the services that load it, such as Apache or PHP-FPM. Updating a content management system alone is not enough.
- Take firewall management interfaces off the public internet. Reach them through a VPN or a dedicated management network.
- Search web and PHP logs for unexpected requests to application endpoints and for unfamiliar child processes started by PHP workers. Karimi's warning about a "suspicious process" points to the pattern to look for.
- Keep public proof-of-concept code out of production. If your team needs to test it, use an isolated lab.
- Confirm each step against the PHP and Palo Alto Networks advisories before you change production systems.

If logs show signs of compromise, isolate the host before patching so you do not overwrite forensic evidence.

## What to watch next

Several open questions will shape how this story develops. Watch whether CISA's catalog settles the federal deadline and whether it adds the Palo Alto CVE that one report named. Palo Alto has not yet published a scale figure for affected firewalls, and the Censys count still needs direct confirmation. Whether CVE-2026-115560 receives a fix will also matter for administrators who thought they were finished after the October patches.

The larger question is timing. Amazon's account shows attackers working before the fixes shipped, so the window between disclosure and exploitation may be shorter than most patch schedules allow. Watch for new product lists from Singapore and other national agencies, and assume the exposure is wider than the first reports suggested until those lists are checked against your own systems.

## Frequently asked questions

### Is my PHP server vulnerable to PHP2Shell?

Run php -v on the server and compare the version with the fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If the installed release is older than the fix for its branch, the server needs patching. Confirm which releases apply to your branch in PHP's own advisory.

### Which PHP versions fix PHP2Shell?

The PHP development team released fixes on October 21, 2026, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both CVE-2026-109618 and CVE-2026-109619 carry a CVSS v4.0 score of 9.2. Verify the list against PHP's advisory before you rely on it.

### Is PHP2Shell being exploited against Palo Alto firewalls?

Singapore's Cyber Security Agency reported active exploitation against internet-exposed management interfaces of Palo Alto Networks firewalls in a November 3 alert. Palo Alto said in an advisory update that exploitation had been observed against its exposed management interface. The scale of any compromise is not publicly known.

### Did CISA add PHP2Shell to its Known Exploited Vulnerabilities catalog?

Yes. CISA added both CVEs to its catalog on October 26, 2026, and urged organizations to treat them as an urgent patching priority. Reports conflict on the federal deadline, so check the catalog entry directly before citing a date.

## Sources

1. [PHP2Shell Threat Escalates As Hackers Target Security Systems, Gain Deeper Network Access — CU Today](https://www.cutoday.info/THE-news/PHP2Shell-Threat-Escalates-As-Hackers-Target-Security-Systems-Gain-Deeper-Network-Access)
2. [Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces — The Hacker News](https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html)
3. [CISA confirms PHP2Shell vulnerabilities now exploited in attacks — BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/)
4. [CISA Warns of PHP2Shell Vulnerabilities Actively Exploited in Attacks — Cybersecurity News](https://cybersecuritynews.com/php2shell-vulnerabilities-actively-exploited/)
5. [CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution — The Hacker News](https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html)
6. [PHP2Shell: Critical PHP Vulnerabilities Enable Unauthenticated Remote Code Execution — Arctic Wolf Labs](https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/)
7. [PHP2Shell: The Critical PHP Flaw That Lets Attackers Run Code on Your WordPress Server — DEV Community](https://dev.to/ahtisham_lala_a1af953f29b/php2shell-the-critical-php-flaw-that-lets-attackers-run-code-on-your-wordpress-server-and-555i)
8. [PHP2Shell security flaws now sucessfully exploited in the wild — BleepingComputer](https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/)