"Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet," the network security company said in an update to its advisory.
Palo Alto Networks' warning and the immediate risk
Palo Alto Networks warned on Wednesday that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly accessible management interfaces. The company said the issue "strictly affects the management web interface, which includes the HTTPS web UI and XML API service," and that the dataplane interface is affected only when a management profile is attached to it. Palo Alto Networks added that no special configuration is required to be affected, and that risk is highest when management access is allowed from external IP addresses on the internet.
PHP2Shell: the vulnerabilities and upstream PHP fixes
The two PHP flaws are tracked as CVE-2026-109618 and CVE-2026-109619, each carrying a CVSS score of 9.2. The PHP Foundation patched the issues upstream on October 21, 2026, in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Palo Alto Networks' advisory identifies these as "PHP2Shell" issues allowing unauthenticated remote code execution on systems running affected PHP versions.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildDream's report: Fragnesia (CVE-2026-46300) chained to PHP2Shell
Days before Palo Alto's advisory, Israeli cybersecurity company Dream reported observing a suspected China-nexus threat actor weaponizing the PHP2Shell flaws in conjunction with a Linux kernel local privilege escalation tracked as Fragnesia (CVE-2026-46300, CVSS 7.8). According to Dream, the attacker used the chain to obtain root on 25 servers across the U.S., Japan, Taiwan, and South Korea, including three systems belonging to a U.S. government-affiliated environment.
Dream said the affected devices "run specific versions of a large vendor's firewall software," and that the attacker "then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration." Dream did not disclose the firewall vendor by name; the company and Palo Alto Networks were contacted for comment by The Hacker News.
CISA adds Fragnesia to the Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) catalog, imposing a federal requirement to apply fixes by October 31, 2026. CISA said, "This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP web shells and run commands as root."
PAN-OS versions affected and vendor mitigations
Palo Alto Networks published a version-by-version list of PAN-OS releases impacted by PHP2Shell and the builds that include fixes. Affected releases and fixes include (excerpted):
- PAN-OS 12.2 — fixed in >= 12.2.4-h1 (impact: < 12.2.4-h1)
- PAN-OS 12.1 — fixes in >= 12.1.4-h13 (ETA: 10/29), >= 12.1.7-h11, >= 12.1.10-h3 (ETA: 10/30)
- PAN-OS 11.2 — multiple fixed builds with ETAs for some (e.g., >= 11.2.4-h23 ETA: 10/30)
- PAN-OS 11.1 and 10.2 — multiple fixed builds listed, with several ETA dates on 10/29–10/30 for fixes
For PAN-OS versions where fixes were not yet available at the time of the advisory, Palo Alto Networks recommended mitigations including routing incoming traffic for the management (MGT) port through a dataplane (DP) port by enabling a management profile on a DP interface, replacing inbound management certificates, decrypting inbound management traffic so the firewall can inspect it, and enabling threat prevention on inbound traffic to management services.
Palo Alto Networks also noted that customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 and later received advance coverage via Threat ID 543004, released at 10:21 PM PT on October 20.
What this means for technologists, federal IT teams, and enterprises
- Technologists and security teams: verify PHP versions (patched upstream on October 21 in 8.5.12, 8.4.27, 8.3.36, 8.2.35) and apply PAN-OS fixes where available or use Palo Alto's recommended mitigations for management access exposed to the internet.
- Federal IT teams and regulators: CISA's addition of CVE-2026-46300 to the KEV catalog carries a firm deadline — fixes must be applied by October 31, 2026 — because CISA explicitly warned the kernel flaw can be chained with the PHP2Shell CVEs to implant web shells and run commands as root.
- Affected enterprises and procurement leaders: confirm whether deployed PAN-OS builds are within the listed impacted ranges and prioritize patches or temporary mitigations, especially where management interfaces are reachable from external IP addresses.
The sequence reported by Dream — weaponized PHP2Shell flaws paired with a Linux kernel local privilege escalation and subsequent Active Directory targeting — underscores a simple technical fact reflected in the public advisories: unauthenticated remote code execution on exposed management interfaces, when combined with local privilege escalation, can yield full system compromise and credential harvesting. That chain prompted both vendor mitigations and an expedited federal response with an October 31 compliance date.
