Palo Alto Confirms Active PHP2Shell Exploitation Targeting Exposed PAN-OS Management Interfaces

Attackers successfully exploited two critical PHP2Shell vulnerabilities chained with a Linux kernel flaw to achieve root access on PAN-OS firewalls and management servers — including systems in a US government-affiliated environment. The core failure was twofold: management interfaces were exposed to the internet rather than isolated behind strict network controls, and patches were not applied before active exploitation began. This matters because firewalls are the foundational layer of network defense — compromising them hands attackers complete visibility and control over an organization's traffic and security posture. The confirmed compromise of 25 devices across multiple countries demonstrates that this is an active, targeted campaign, not a theoretical risk.