Threat Actors Exploiting Critical PHP2Shell Vulnerabilities in Palo Alto Networks Management Interfaces

Palo Alto Networks has issued a warning that threat actors are actively exploiting recently patched PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) against publicly accessible management interfaces. These flaws allow unauthenticated remote code execution. Additionally, a suspected China-nexus threat actor has been observed chaining these with a Linux kernel privilege escalation bug (CVE-2026-46300, CVSS 7.8) to compromise servers, prompting CISA to add CVE-2026-46300 to its Known Exploited Vulnerabilities catalog.