Executive summary

I just read a SecurityWeek report on a wave of exploitation of the PHP2Shell bug that has been running for over a week, and what's interesting is precisely the gap in outcomes: a handful of Palo Alto Networks firewalls were fully rooted, while millions of targeted WordPress installations barely saw any successful breaches. This is a good example of why the number of exploitation attempts doesn't directly correlate with the number of actual victims.

The problem it solves

This isn't about a "solution", but about a real incident. Two CVEs, CVE-2026-109618 and CVE-2026-109619, exist in the PHP2Shell feature on PAN-OS, and were exploited via the management interface exposed to the internet. What makes this attack dangerous isn't just the bug itself, but the fact that it was chained with a Linux kernel privilege escalation bug called Fragnesia. This combination of two exploits — one to get in, one to escalate to root — was used by a China-linked hacking group to deploy a webshell with root privileges on the firewall. According to the report, the process was AI-assisted. On the other hand, PHP itself is widely used in CMSs like WordPress, Drupal, and Joomla, so the attack surface is large, but successful execution turned out to be far harder than expected.

Key features and code examples

Some concrete figures I noted from the report:

  • Palo Alto Networks has released patches for PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2, covering PA-Series, VM-Series, and Panorama (both virtual and M-Series).
  • Dream Research reported at least 25 firewalls successfully compromised out of hundreds targeted, and Unit 42 (Palo Alto's research team) has independently verified this finding.
  • The company stated that only about 0.02% of their total global installation base had a management interface exposed to the internet and was affected — and those customers have been contacted individually.
  • Palo Alto's telemetry as of October 29 recorded more than 22.6 million PHP instances potentially affected by the PHP2Shell bug.
  • Defiant (maker of Wordfence) recorded more than 77,000 exploitation-related requests from over 2,000 IPs, but as of October 28 not a single WordPress site has been confirmed breached — the public exploit turns out to need adjustment depending on ASLR, PHP build, active extensions, memory limit, and how the server handles requests.
  • Cato Networks recorded that about 96% of the attacks they blocked targeted CVE-2026-109618, with 41% of those attempting remote code execution (RCE), the rest being scanning or failed PoCs.
  • WatchTowr observed one IP in Germany that successfully exploited the bug, but only ran a simple curl command to prove success — without any further post-exploitation activity.

Since the report doesn't include payload details, here's a simple illustration (not from the source, just a depiction of basic mitigation steps relevant for PAN-OS admins):

# Ilustrasi: cek dan tutup akses management interface PAN-OS dari internet
# (perintah aktual tergantung versi PAN-OS dan setup jaringan Anda)
ssh admin@firewall
> set deviceconfig system permitted-ip <IP_INTERNAL_ONLY>
> commit

Impact and upgrade notes

If you have a Palo Alto firewall with a management interface exposed to the internet, this is an emergency priority: apply the released PAN-OS patch and immediately restrict access to that management interface, because according to the official advisory, active exploitation doesn't require any special configuration on the victim's side — the interface just needs to be open to the internet. For WordPress/Drupal/Joomla administrators, this report is no reason to relax; Defiant still emphasizes that updating PHP is essential, because attackers keep adjusting their tooling and a successful exploit could grant access to files, databases, and site passwords.

---

First announced on SecurityWeek. Read the original source for full details.

Read also