Cybersecurity · VIDEO
PHP2Shell: 22.6 million servers exposed and attacks on Palo Alto firewalls
A campaign of attacks is exploiting the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to compromise Palo Alto Networks firewalls, combining the exploit with the Fragnesia bug to gain root privileges. Palo Alto has released patches for PAN-OS and advises limiting access to the management interface. Over 22.6 million exposed PHP instances are potentially vulnerable, with opportunistic attacks targeting various sectors.
KEY TAKEAWAYS
- Attacks combine PHP2Shell and Fragnesia to root Palo Alto firewalls
- Patches available for PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2
- 22.6 million PHP servers at risk of compromise
- Opportunistic attacks targeting healthcare, technology and professional services
- Only 0.02% of Palo Alto firewalls exposed to the internet have been hit
Transcript
At least 25 Palo Alto Networks firewalls have been compromised in a targeted campaign exploiting two critical vulnerabilities, PHP2Shell and Fragnesia. The attackers, linked to China, leveraged CVE-2026-109618 and CVE-2026-109619 to gain root privileges on PAN-OS devices. Palo Alto has released patches for PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2.
The attacks combined exploits to deploy webshells with root privileges, using advanced AI-assisted tools. Palo Alto Networks' Dream research organization confirmed the campaign, urging customers to restrict access to the management interface and apply available fixes. Over 22.6 million potentially vulnerable exposed PHP instances have been identified, with healthcare, technology, and commercial sectors most affected.
Cato Networks reported that 96% of blocked attacks targeted the CVE-2026-109618 vulnerability, with 41% attempting remote code execution. WatchTowr observed successful exploitation from a single IP address in Germany, though no further post-exploit activity was noted.
Palo Alto Networks emphasizes the importance of applying patches and restricting access to the management interface. Organizations are advised to consider cyber insurance and incident response services to mitigate financial risks and quickly address such attacks. The evolving sophistication of exploits underscores the need for dynamic incident response capabilities.
