PHP2Shell on PAN-OS: fixes for five branches and Panorama

Palo Alto Networks has released fixes for the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in its firewalls and in Panorama, and has made clear that the exploitation observed targets management interfaces exposed to the internet. This is reported by SecurityWeek, which also takes stock of the wave of attacks against PHP: a huge number of attempts, very few confirmed successes. Iceland’s CERT-IS has urged organisations to update as soon as possible and to restrict access to the management interface.

The chain with Fragnesia that led to root on PAN-OS 12.1 and 12.2 firewalls is covered in our article of 28 October; the CVEs, the fixed PHP versions and the addition to the KEV catalogue are in the earlier articles. What follows is what’s new.

Palo Alto Networks’ advisory

According to SecurityWeek, the fixes cover:

• PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 for PA-Series and VM-Series firewalls;
• Panorama, both virtual and M-Series.

The sources do not give the individual fixed version numbers: check them in the vendor’s advisory, published under the identifier CVE-2026-109618 (it is among the references listed by CERT-IS).

In the advisory, quoted by SecurityWeek, Palo Alto Networks writes that no special configuration is required to be affected and that active exploitation has been observed against the management interface exposed to the internet. By default, the interface is not exposed. The vendor estimates that only a tiny fraction of its installed base, about 0.02%, has an internet-facing management interface and was impacted, and says it has contacted each of these customers individually.

CERT-IS adds that the flaw can be exploited only by those who can reach the device’s management interface. It asks organisations to restrict access to it as much as possible and to update at the earliest opportunity; those who cannot should follow the vendor guidance in the advisory.

In practice the risk varies widely from one firewall to another: a management interface reachable only from a dedicated network is within reach only of someone already inside the network, while one exposed to the internet is the target of the compromises documented so far.

Mass exploitation: many attempts, few successes

Also according to SecurityWeek, as of 29 October Palo Alto Networks’ telemetry counted more than 22.6 million exposed PHP instances that are potentially vulnerable. For other targets, the data gathered by the publication show that successful exploitation remains rare:

• WordPress: Defiant, a web security company, was not aware of any site compromised via PHP2Shell as of 28 October, despite more than 77,000 related requests from over 2,000 IP addresses. In its testing, exploits have to be adapted to each server: ASLR, the PHP build, loaded extensions, memory limits and request handling all matter. Defiant warns that attackers are still refining their tools.
• Cato Networks: about 96% of the attacks it blocked targeted CVE-2026-109618 and 41% attempted code execution; the rest were scans or invalid PoCs. The requests came from a handful of IP addresses in the United States, the Netherlands and Germany: mostly command execution attempts and, secondly, deserialisation attempts. The most targeted sector is healthcare, followed by technology and security services, professional services, automotive, education and non-profit, manufacturing, construction and retail. According to Cato the attacks were opportunistic: the same source hit different sectors on the same day.
• watchTowr: it observed successful exploitation from a single IP address in Germany, which each time runs a simple curl command to prove execution and stops there, with no further activity. Jake Knott, head of threat intelligence, expects more reliable, appliance-specific exploits, and therefore more cases of targeted exploitation against edge devices.

The sources do not publish the IP addresses: there are no usable indicators of compromise.

MITRE ATT&CK techniques: T1190 (Exploit Public-Facing Application) and, for the reconnaissance part, T1595 (Active Scanning).

Impact for European and Italian companies

Two points concern Europe directly. Part of the attack traffic seen by Cato and the only successful exploiter observed by watchTowr use addresses in Germany and the Netherlands, which however say nothing about who the attackers are. And healthcare is the most targeted sector.

For hospitals and healthcare providers, and for every entity in scope of NIS2, a firewall management interface reachable from the internet is an exposure to close and to document; if a device turns out to be compromised, the incident must be assessed for notification to the national CSIRT (CSIRT Italia in Italy). Palo Alto Networks contacting the affected customers directly is no substitute for your own check. The same applies to third-party appliances based on PAN-OS, such as the Siemens RUGGEDCOM APE1808 mentioned on 21 October.

What to do now

1. Management interface: check from the outside that the interface of your firewalls and of Panorama is not reachable from the internet; allow it only from a management network or trusted internal addresses, and also review the management profiles assigned to data interfaces.
2. Update PAN-OS and Panorama to the fixed version for your branch listed in Palo Alto Networks’ advisory; if you cannot do so right away, apply the alternative measures in the advisory, as CERT-IS recommends.
3. If the interface was exposed, treat the device as one to investigate: capture memory before rebooting, look for new PHP files in web folders, outbound SSH tunnels and unusual access to the management server, as described in our article of 28 October.
4. PHP servers: update even where no successful attacks have been seen, as Defiant recommends for WordPress: exploits keep being adapted.
5. Detection: look for PHP or web server processes launching curl towards external addresses (the pattern seen by watchTowr), bursts of multipart POST requests and PHP worker crashes.
6. Healthcare: give priority to the exposed systems of hospitals, laboratories and healthcare service providers, the most targeted sector according to Cato.

How ARXDOME helps

ARX Expose shows which of your company’s public services expose recognised products, and ARX Scout verifies first-hand which ports and services are actually open: together they help uncover a management interface reachable from the internet. ARX Sentry collects firewall logs, with dedicated pages on firmware status, and ARX Radar recognises scans and sources hitting several companies in the incoming traffic. ARX Shield shows open vulnerabilities per machine, highlighting those already exploited.

Last updated: 1 November 2026