PHP2Shell flaws exposed critical infrastructure's dependence on underfunded PHP Foundation

What changed · following since Oct 25 Oct 30 — Palo Alto Networks confirmed active exploitation against internet-exposed PAN-OS management interfaces and is releasing fixed versions across affected branches.

The attack surface has widened from PHP itself to critical network infrastructure: Palo Alto Networks has confirmed active exploitation of the PHP2Shell vulnerabilities against internet-exposed PAN-OS management interfaces, with fixed versions now shipping across affected branches. The vendor's validation of the China-suspected actor's tooling—and the direct path from firewall compromise to Active Directory—transforms this from a language runtime issue into a perimeter security crisis. The convergence of AI-assisted exploit development with exposed management interfaces demonstrates how a single upstream vulnerability cascades through the supply chain.

• Palo Alto Networks confirmed active exploitation targeting internet-exposed PAN-OS management interfaces and is releasing fixed versions across affected branches, with Unit 42 independently verifying the attacker's tooling and results.
• The exploited surface is the PAN-OS management web server, which also fronts the GlobalProtect portal, allowing attackers to leverage PHP2Shell for unauthenticated remote code execution.
• CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on October 26, confirming active exploitation and ordering federal civilian agencies to patch within three days.
• A suspected China-nexus threat actor observed on October 25 combined PHP2Shell with a Linux kernel privilege escalation vulnerability tracked as Fragnesia to root 25 servers across the U.S., Japan, Taiwan, and South Korea.
• After rooting the firewalls, the attacker launched attacks against Active Directory with confirmed credential extraction and directory enumeration.
• Patched versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are available; Sansec reports the vulnerabilities are present in every unpatched PHP since version 5.4.

Bottom line With a major firewall vendor confirming active exploitation of its management interfaces and releasing emergency fixes, this is now a critical perimeter security incident; patch PAN-OS immediately, restrict management interface exposure, and audit Active Directory for indicators of compromise.