Attackers Actively Exploiting PHP2Shell Vulnerabilities in Internet-Exposed Palo Alto Networks Management Interfaces

Palo Alto Networks has issued a warning regarding active exploitation of recently patched PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) targeting publicly-accessible management interfaces. These flaws, with CVSS scores of 9.2, allow attackers to achieve unauthenticated remote code execution on systems running affected PHP versions. Threat actors have been observed weaponizing these vulnerabilities, sometimes in conjunction with a Linux kernel privilege escalation bug (CVE-2026-46300), to compromise servers.

Context

Palo Alto Networks recently patched vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, which affect systems running certain PHP versions. These vulnerabilities have been categorized with critical severity, indicating a high likelihood of exploitation. The presence of a related Linux kernel privilege escalation bug further complicates the security landscape.

Why it matters

The exploitation of PHP2Shell vulnerabilities poses a significant risk to organizations using Palo Alto Networks management interfaces. With high CVSS scores, these flaws enable attackers to execute code remotely without authentication. This could lead to severe data breaches and operational disruptions, impacting both security and trust in affected systems.

Implications

The active exploitation of these vulnerabilities could lead to unauthorized access and control over critical systems. Businesses relying on affected Palo Alto Networks products may face increased scrutiny and potential regulatory consequences. Additionally, the incident underscores the need for robust cybersecurity measures across all internet-exposed services.

What to watch

Organizations should monitor their systems for signs of exploitation related to these vulnerabilities. It is crucial to ensure that all patches are applied promptly and to review security protocols around management interfaces. Upcoming security advisories from Palo Alto Networks may provide additional insights or measures to mitigate risks.