PHP2Shell: 22.6 million servers exposed and attacks on Palo Alto firewalls
Vulnerabilities CVE-2026-109618 and CVE-2026-109619 exploited with Fragnesia for root access
KEY TAKEAWAYS
- Attacks combine PHP2Shell and Fragnesia to root Palo Alto firewalls
- Patches available for PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2
- 22.6 million PHP servers at risk of compromise
- Opportunistic attacks targeting healthcare, technology and professional services
- Only 0.02% of Palo Alto firewalls exposed to the internet have been hit
PHP2Shell Attacks: 25 Palo Alto Firewalls Compromised in a Targeted Campaign
At least 25 Palo Alto Networks firewalls have been compromised in an attack campaign that combines two critical vulnerabilities: PHP2Shell and Fragnesia. The attackers, linked to China, exploited the vulnerabilities CVE-2026-109618 and CVE-2026-109619 to gain root privileges on PAN-OS devices.
Quick Response
- 25 Palo Alto firewalls compromised in attacks combining PHP2Shell and Fragnesia
- Critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 exploited to gain root privileges
- Palo Alto has released patches for PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2
- 22.6 million potentially vulnerable exposed PHP instances
- Opportunistic attacks on healthcare, technology, and commercial sectors
Technical Details of the Attack
The attacks were made possible through the use of advanced AI-assisted tools. The attackers chained two separate exploits: one to exploit the PHP2Shell vulnerabilities on PAN-OS devices and another to exploit the Fragnesia vulnerability in the Linux kernel, allowing the deployment of webshells with root privileges.
Palo Alto Networks' Response
The Dream research organization was the first to report the campaign, confirming that at least 25 firewalls out of hundreds have been compromised. Palo Alto Networks independently verified the attackers' tools and confirmed the reported results. The company has released patches for PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 for PA-Series, VM-Series, and Panorama.
Security Recommendations
Palo Alto Networks emphasizes that the management interface is not exposed to the internet by default and urges customers to immediately restrict access to it and apply the available fixes. According to the company, only a fraction of 0.02% of the global installed base has management interfaces exposed to the internet and is affected.
Impact on PHP and Other Platforms
According to Palo Alto Networks data, over 22.6 million potentially vulnerable exposed PHP instances have been identified. PHP is widely used in servers and content management systems, including WordPress, Drupal, and Joomla.
Analysis of PHP2Shell Attacks
Defiant, a web security company, reported that as of October 28, it was not aware of any WordPress sites compromised through the PHP2Shell exploit, despite having recorded over 77,000 related requests from more than 2,000 IP addresses. However, Defiant warned that a successful attack could give attackers access to site files, databases, and passwords, making it essential to update PHP.
Origin and Targets of the Attacks
According to Cato Networks, 96% of the blocked attacks targeted the CVE-2026-109618 vulnerability, with 41% of them attempting remote code execution (RCE). The attacks originated from a few IP addresses in the United States, the Netherlands, and Germany, focusing on command execution and deserialization attempts.
Most Affected Sectors
Healthcare organizations were the most affected, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail. However, the attacks were not targeted but rather opportunistic, with the same sources sending requests to organizations in different sectors on the same day.
WatchTowr Observations
WatchTowr observed the successful exploitation of PHP2Shell from a single IP address in Germany, despite the large volume of attempts and the variety of payloads. In each case, the attack executed a simple 'curl' command to demonstrate the success of the exploit and stopped there, with no further post-exploit activity.
Future Perspectives
Jake Knott, threat intelligence lead at WatchTowr, stated that new techniques, inventive payloads, and more reliable exploits are emerging as more reliable exploits are developed. Reports of targeted and successful exploitation of specific edge devices are expected to increase.
Compliance and Security
For affected organizations, it is crucial to consider implementing a cyber insurance to mitigate the financial risks associated with such breaches. Additionally, adopting an incident response service can help contain and quickly respond to such attacks.
Frequently Asked Questions
Which PAN-OS versions are affected?
The affected versions are PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 for PA-Series and VM-Series firewalls, and for Panorama (virtual and M-Series).
How can I protect my Palo Alto Networks firewall?
Restrict access to the management interface and immediately apply the available patches. Palo Alto Networks has released fixes for the PHP2Shell vulnerabilities.
Which sectors have been most affected by PHP2Shell attacks?
Economic and Insurance Impact
The compromise of critical firewalls like those from Palo Alto Networks can have significant economic repercussions. Affected organizations may face high costs for breach remediation, including security audits, system restoration, and potential fines for violating NIS2 compliance or the DORA regulation. Adequate cyber insurance could mitigate some of these risks, but the cost of cyber insurance is expected to increase for companies exposed to vulnerabilities like PHP2Shell.
Evolution of Exploits and Attack Techniques
Attacks combining PHP2Shell and Fragnesia represent a concerning evolution in the sophistication of exploits. The use of AI-assisted tools to chain different vulnerabilities indicates a trend towards advanced automation in cyberattacks. This technique could be reused against other edge network devices, increasing the risk to critical infrastructures.
Challenges for Incident Response
The complexity of current attacks requires a more dynamic approach to incident response. A Managed Security Operations Center or an MDR service (Managed Detection and Response) could be essential to quickly detect and contain these threats. Organizations must assess whether their current incident response capability is sufficient to address such sophisticated attack campaigns.
Security Market Trends
The increasing sophistication of attacks is pushing companies to invest in more advanced Data Loss Prevention and SIEM (Security Information and Event Management) solutions. Additionally, the need for ISO 27001 certification or more rigorous security audits is becoming a priority for many organizations, especially those operating in regulated sectors.
Protection Against Advanced Attacks
For organizations using PHP, it is crucial to implement robust ransomware protection and ransomware recovery measures. This includes regularly updating PHP and adopting best practices for vulnerability management. Additionally, enterprise backup and business continuity solutions can help minimize the impact of any compromises.
Implications for Identity Management
Attacks exploiting vulnerabilities like PHP2Shell underscore the importance of robust identity access management (IAM). Implementing a zero trust architecture can help limit the damage caused by any compromises, ensuring that only authorized users and devices can access critical resources.
Future Perspectives and Forecasts
Attacks combining multiple vulnerabilities are expected to become more common as attackers develop more reliable exploits and sophisticated attack techniques. Organizations must prepare for a new era of cyber threats, investing in advanced security solutions and adopting a proactive approach to risk management.
Frequently Asked Questions
What are the economic implications of a PHP2Shell attack?
The economic implications include high costs for breach remediation, potential fines for violating NIS2 compliance or the DORA regulation, and an increase in the cost of cyber insurance.
How can I protect my PHP systems from attacks?
Implement ransomware protection measures, adopt best practices for vulnerability management, and regularly update PHP. Additionally, enterprise backup and business continuity solutions can help minimize the impact of any compromises.
What is the importance of a Managed Security Operations Center in this context?
A Managed Security Operations Center or an MDR service can be essential to quickly detect and contain sophisticated threats like those combining PHP2Shell and Fragnesia.
Editorial Note and Disclaimer
The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.
GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.
The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the improper use of the information published.
In the Crypto sector, every investment involves risks: readers are invited to always inform themselves autonomously before making any decision.
Source: securityweek.com · GoYou.it is not a registered news outlet; all content is for informational and educational purposes.
