Palo Alto Networks confirmed on October 29, 2026 that attackers are actively exploiting the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), against PAN-OS management interfaces exposed to the internet. The update lands days after Israeli security firm Dream reported a suspected China-nexus operation that chained a custom PHP2Shell exploit with the Linux kernel bug Fragnesia (CVE-2026-46300) to gain root on 25 servers across the U.S., Japan, Taiwan, and South Korea, including systems in a U.S. government-affiliated environment, before pivoting into Active Directory. CISA has added Fragnesia to its Known Exploited Vulnerabilities catalog with an October 31 federal deadline, and the PHP2Shell KEV deadline already passed on October 29. If you manage Palo Alto firewalls or Panorama, here’s what happened, which builds fix it, and why your management plane needs attention today.
From PHP Bug to Firewall Root
PHP2Shell is a pair of memory-safety bugs in PHP’s fatal-error handling that the PHP project patched on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Because PAN-OS runs PHP behind its management web server, the bugs carried straight into the firewall’s HTTPS web UI and XML API. As Palo Alto put it, “Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.”
According to Dream, the attacker’s exploit was a custom, non-public build tailored to PAN-OS. Code execution landed as the low-privileged web server user, which SELinux confines, so the operator added a second stage:
- Stage one, PHP2Shell: unauthenticated remote code execution through the management web server’s PHP upload-progress handling.
- Stage two, Fragnesia: a Dirty Frag-class kernel bug in the XFRM ESP-in-TCP code that lets a local user write into cached file data, which the attacker used to rewrite the PAM rules for su so root required no password.
- Speed: Dream says the full chain, from an unauthenticated HTTPS connection to a persistent root webshell, finished in under 15 minutes.
- Preparation: the attacker obtained and decrypted PAN-OS firmware and built memory profiles for nine software versions, according to Dream.
Which PAN-OS Builds Fix It
Palo Alto’s advisory lists hotfixes across every supported train, and The Hacker News reports that as of October 30 fixes are out for all vulnerable versions of 12.2, 12.1, 11.2, 11.1, and 10.2. The top-of-branch targets are:
- PAN-OS 12.2: 12.2.4-h1 or later.
- PAN-OS 12.1: 12.1.10-h3 or later (or 12.1.7-h11 and 12.1.4-h13 on older maintenance lines).
- PAN-OS 11.2: 11.2.16-h1 or later, with hotfixes back to 11.2.4-h23.
- PAN-OS 11.1: 11.1.16-h4 or later, with hotfixes back to 11.1.4-h38.
- PAN-OS 10.2: 10.2.18-h13 or later, with hotfixes back to 10.2.7-h39.
- Unsupported releases: upgrade to a supported fixed version, since no fix is coming for them.
Palo Alto notes that GlobalProtect portal, gateway, and Clientless VPN are not impacted, and data-plane interfaces are affected only if a management profile is attached to them.
Why It Matters for IT Teams
Palo Alto says only a small fraction of a percent of its installed base exposes management to the internet, and that each affected customer has been contacted individually. That is little comfort if one of those boxes is yours, and the blast radius here is the whole network: the attacker in Dream’s report reached internal firewall management and then went after Active Directory, with recovered artifacts confirming credential extraction and directory enumeration.
Fragnesia also matters well beyond Palo Alto. It affects major Linux distributions with kernels released before May 13, 2026, and appliance firmware often trails distribution kernels by months. As CISA warned, “This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP web shells and run commands as root.”
What to Do Right Now
- Close the door first: remove any public internet access to PAN-OS and Panorama management interfaces, and restrict management to trusted internal IPs or a jump box.
- Patch next: move to the fixed hotfix for your branch from the table above.
- Check data-plane profiles: audit interfaces that carry a management profile, since those expose the same web UI.
- Hunt if you were exposed: treat any internet-facing management interface as potentially compromised, review admin activity and new accounts, and rotate firewall and AD credentials touched by the device.
- Ask your other vendors: confirm whether their appliance firmware includes the May kernel fix for Fragnesia and the October PHP fixes.
For builds still awaiting a hotfix, Palo Alto’s interim guidance includes routing management traffic through a data-plane port with a management profile so it can be decrypted and inspected, and enabling threat prevention on that inbound traffic.
Looking Ahead
This campaign is a textbook example of how quickly a library bug becomes an appliance crisis. PHP2Shell went from upstream patch to root on firewalls in a matter of days, and the attacker paired it with a months-old kernel flaw that many embedded systems never picked up. Expect more vendors that bundle PHP or older Linux kernels to publish their own PHP2Shell and Fragnesia advisories in the coming weeks.
The durable lesson is the oldest one in firewall hygiene: management planes do not belong on the internet. Patch today, but also use this moment to inventory every appliance whose admin interface is reachable from outside, because the next chain may not wait for a vendor advisory.
Sources:
- Palo Alto Networks Security Advisory, October 29, 2026
- Palo Alto Networks Unit 42, October 29, 2026
- Dream Research, October 26, 2026
- CISA, October 28, 2026
- The Hacker News, October 29, 2026
- BleepingComputer, October 29, 2026
