Patches for PHP2Shell went public on Wednesday, Oct. 21, but attackers were already working the bug. Security researchers at Amazon said they found evidence of exploitation four days before those releases, according to TechCrunch. This week the bug spread beyond web servers, as Okta and Palo Alto Networks disclosed that their products are affected.
For US firewall, identity and web-server operators, the story has moved from a PHP problem to an infrastructure problem. Each new vendor disclosure adds another team that has to check versions and schedule upgrades.
Why the PHP2Shell patch window forced hard choices
PHP2Shell is a critical flaw class in PHP, the scripting language behind a large share of the web. TechCrunch reported that about 70% of websites use PHP, which explains how a single bug family can reach so many sites at once.
The patch release was coordinated globally so that large organizations could fix their systems ahead of possible attacks. TechCrunch reported that the bug prompted companies and governments around the world to pull their sites down while they applied fixes before attackers could exploit it.
That left many operators with a bad choice. Taking a site offline cut off exposure but cost traffic and revenue. Keeping it live meant running vulnerable code while exploitation was already being attempted.
PHP2Shell timeline from patch release to vendor advisories
The dates show how the story widened after the public patch.
| Date (2026) | What happened | Source |
|---|---|---|
| Oct. 17 (four days before the patch release) | Amazon researchers observed evidence of exploitation | TechCrunch |
| Oct. 21 (Wednesday) | Public PHP2Shell patch release | TechCrunch |
| Oct. 22 | Okta discloses four Access Gateway flaws in three advisories | SecurityOnline, Okta Trust |
| Oct. 24 | Palo Alto Networks confirms two critical PHP flaws affect PAN-OS | Cyber Security News |
Okta followed one day after the public patch, and Palo Alto followed three days later. Each disclosure pulled in a different set of administrators.
Palo Alto PAN-OS is now part of the PHP2Shell story
Palo Alto Networks confirmed on Oct. 24 that two critical PHP remote code execution vulnerabilities affect PAN-OS, the operating system for its firewalls, according to Cyber Security News. The confirmation also noted that the flaws previously impacted two cloud services. Coverage of the disclosure cites CVE-2026-109618.
This is the most consequential detail for network teams. A PHP flaw in a firewall operating system means the bug class reaches devices at the network edge, not only the websites behind them. Security teams that never ran PHP in their own stack now have a patch item on their list.
The gap is real. The affected PAN-OS versions and fixed releases were not in the reporting reviewed for this story, and the confirmation came through a summary rather than the full advisory. Operators should open Palo Alto's security advisory directly and compare their PAN-OS release against it.
Okta Access Gateway has PHP flaws and an admin console bug
Okta disclosed four Access Gateway flaws in three advisories on Oct. 22, according to SecurityOnline. The set includes PHP2Shell flaws in the PHP runtime and a CVSS 9.1 command execution bug in the Admin Console. Okta's table also lists CVE-2026-109619, the second PHP flaw, with a CVSS 9.2 score.
Fixes ship in Access Gateway 2026.10.2 and 2026.44.0. Administrators should choose the release that matches their deployment line, and Okta's advisories are the place to confirm which one applies.
Okta's table also contains a conflict that has not been resolved. It lists the PHP flaws as "not exploited," yet the same table shows a "1 of 4 confirmed" exploit entry. Until Okta clarifies, treat the PHP flaws as exploitable and patch on that basis.
CVE-2026-115547 requires an admin foothold
CVE-2026-115547 is a command execution flaw triggered through input to the Okta Access Gateway Admin Console, according to Okta's security advisory. Okta scores it CVSS v3.1 9.1 and says it affects appliance versions before 2026.10.2. The precondition is an authenticated user with administrative access to the Admin Console, so this is not an unauthenticated flaw.
That makes it narrower than the PHP bugs. It does not hand a stranger on the internet a shell. Identity appliances are still attractive targets because admin accounts sit close to everything else, and an attacker with an admin login has a much shorter path. Our earlier reporting on k0t hackers harvesting 70,000 credentials from FortiGate and GlobalProtect shows how stolen logins for network gear keep turning into footholds.
What the Mirai and ASLR reports do and do not show
SecurityWeek reports that researchers tie some PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, though no successful compromise has been confirmed yet. Mirai is a botnet family known for recruiting internet-connected devices at scale. ASLR, or address space layout randomization, shuffles where program code sits in memory so exploits are harder to write. A bypass weakens that defense, which is why researchers track it closely.
Scale is the other signal. A headline from DataBreachToday reports that millions of exploit attempts have been logged against PHP servers. The full figures were not available for this report, so read the number as a measure of probing rather than confirmed breaches.
Several questions remain open. It is not clear whether CISA has added the PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog, and the sources reviewed did not settle the question. Whether any PAN-OS or Okta deployment has been compromised is unknown. The scope of Mirai involvement is still under analysis.
Steps to take this week
Operators who run these systems can act now, using the vendor and reporting sources above.
- Confirm the PHP version on every site and application, apply the patched release, and ask your hosting provider when shared stacks will be patched. Verify that any site taken down during the window is patched before it returns.
- Check Palo Alto's security advisory for affected PAN-OS versions and fixed releases, then compare them with your firewall inventory.
- Upgrade Okta Access Gateway to 2026.10.2 or 2026.44.0, depending on which release fits your deployment.
- Restrict access to the Okta Access Gateway Admin Console to trusted management networks, and review which accounts hold admin rights. CVE-2026-115547 requires administrative access, so limiting that access narrows the path.
- Review web server and gateway logs for unusual requests to PHP endpoints or admin interfaces, and keep those logs for the period when your systems were exposed.
What to watch next
The next signals are concrete. Palo Alto's full advisory will show which PAN-OS versions need fixes, and Okta needs to clarify whether its PHP flaws have been exploited. Watch for a CISA catalog listing, which would set a federal patch deadline, and for any confirmed compromise tied to the Mirai activity.
The patch load compounds the problem. Oracle's October patch update fixed 1,209 CVEs, including six rated CVSS 10.0. Teams working through PHP, PAN-OS and Okta fixes this week are competing for the same change windows.
The most useful outcome would be a clear list of affected versions from each vendor and a settled answer on exploitation. Until then, US operators should assume exposure, patch the components they own, and treat admin access to identity and firewall appliances as the control that matters most.
