Palo Alto Confirms Active PHP2Shell Exploitation Targeting Exposed PAN-OS Management Interfaces

Palo Alto Networks has confirmed active exploitation of PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) against PAN-OS management interfaces exposed to the internet. These critical flaws, with a CVSS score of 9.2, allow remote code execution without authentication. Attackers are reportedly combining these PHP flaws with a Linux kernel vulnerability to gain root access. Palo Alto's Unit 42 has contacted affected customers.