Palo Alto Networks Warns of Active Exploitation of PHP2Shell Vulnerabilities in Management Interfaces

Palo Alto Networks has issued a warning regarding active exploitation of recently patched PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) against publicly-accessible management interfaces. These vulnerabilities allow unauthenticated remote code execution on affected PHP systems. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a related Linux kernel privilege escalation bug (CVE-2026-46300), which can be chained with the PHP flaws, to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply fixes by October 31, 2026. The risk is highest when management interfaces are exposed to the internet.