[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOa3_nzFb6HiEy57r_rTeqZpMec54hbDmOPw3G-qfGDc":3},{"article":4,"iocs":51,"watch_terms":61,"solutions":62,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"07d1db95-fcee-421d-9b5e-dc8087181d97","Palo Alto Confirms Active PHP2Shell Exploitation Targeting Exposed PAN-OS Management Interfaces","palo-alto-confirms-active-php2shell-exploitation-targeting-exposed-pan-os-manage-471b78","Palo Alto Networks has confirmed that attackers are actively exploiting PHP2Shell vulnerabilities against PAN-OS management interfaces exposed to the internet. In its October 29, 2026, update, Unit 42 said it independently verified attacker tools used to combine the PHP flaws with a Linux kernel vulnerability and gain root access. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each […] The post Palo Alto Confirms Active PHP2Shell Exploitation Targeting Exposed PAN-OS Management Interfaces appeared first on Cyber Security News.","Attackers are actively exploiting PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) against exposed PAN-OS management interfaces. These critical flaws, combined with a Linux kernel vulnerability (CVE-2026-46300), allow attackers to gain root access. Palo Alto Networks has identified a campaign compromising 25 PAN-OS firewalls and management servers across multiple countries, including a US government-affiliated environment.","Palo Alto Networks confirms active exploitation of PHP2Shell flaws in PAN-OS management interfaces.","https:\u002F\u002Fcybersecuritynews.com\u002Fpalo-alto-php2shell-exploitation\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FPalo-Alto-PHP2Shell-Exploitation.webp","2026-10-30T10:42:02+00:00","2026-10-30T11:00:08.373919+00:00",9,[17,20,23,26],{"name":18,"type":19},"PAN-OS","product",{"name":21,"type":22},"Palo Alto Networks","vendor",{"name":24,"type":25},"PHP","technology",{"name":27,"type":25},"Linux kernel","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56,58],{"type":53,"value":54,"context":55},"cve","CVE-2026-109618","PHP2Shell vulnerability in PAN-OS",{"type":53,"value":57,"context":55},"CVE-2026-109619",{"type":53,"value":59,"context":60},"CVE-2026-46300","Linux kernel vulnerability (Fragnesia)",[21,18],{"controls":63,"vendors":147},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":94,"name":95,"problem":96,"products":97},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","attack-surface-intelligence","Attack Surface Intelligence","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fattack-surface-intelligence","External attack surface management that discovers internet-facing assets and prioritises their exposures.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"outpost24","Outpost24","\u002Fvendor-logos\u002Foutpost24.png","outpost24-easm","Outpost24 EASM","https:\u002F\u002Foutpost24.com\u002Fproducts\u002Fexternal-attack-surface-management\u002F","Discovery and risk assessment of internet-facing assets.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"censys","Censys","\u002Fvendor-logos\u002Fcensys.png","censys-external-exposure-management","Censys External Exposure Management","https:\u002F\u002Fcensys.com\u002Fsolutions\u002Fexternal-exposure-management","External attack surface discovery based on continuous internet-wide scanning.",{"slug":123,"name":124,"problem":125,"products":126},"patch-management","Automated patch management","Known holes get closed in days, not months.",[127,135,139],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":123,"product_name":136,"url":137,"description":138},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",[148],{"slug":149,"name":21,"logo_path":150,"roles":151},"palo-alto-networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[152,153],"reported_by","affected",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":166},"exposed-pan-os-management-interfaces-exploited-via-critical-php2shell-flaws","Exposed PAN-OS Management Interfaces Exploited via Critical PHP2Shell Flaws","Attackers successfully exploited two critical PHP2Shell vulnerabilities chained with a Linux kernel flaw to achieve root access on PAN-OS firewalls and management servers — including systems in a US government-affiliated environment. The core failure was twofold: management interfaces were exposed to the internet rather than isolated behind strict network controls, and patches were not applied before active exploitation began. This matters because firewalls are the foundational layer of network defense — compromising them hands attackers complete visibility and control over an organization's traffic and security posture. The confirmed compromise of 25 devices across multiple countries demonstrates that this is an active, targeted campaign, not a theoretical risk.",[159,160,161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","MITRE ATT&CK T1190: Exploit Public-Facing Application",{"NIS2 Article 21(2)(b)":167,"NIST SP 800-53 SI-2: Flaw Remediation":168,"CIS Control 12: Network Infrastructure Management":169,"CIS Control 7: Continuous Vulnerability Management":170,"MITRE ATT&CK T1190: Exploit Public-Facing Application":171,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":172,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":173},"NIS2 requires essential-service operators to implement incident handling and vulnerability management measures; the compromise of a US government-affiliated environment highlights the regulatory obligation to protect critical network infrastructure.","SI-2 mandates identifying, reporting, and correcting system flaws within organisation-defined timeframes, a process that would have closed the critical PHP2Shell vulnerabilities before active exploitation occurred.","This control requires securing and restricting access to network device management interfaces, directly addressing the root misconfiguration of exposing PAN-OS management to the internet.","A structured vulnerability management programme with defined patching timelines would have ensured the PHP2Shell and kernel CVEs were remediated before attackers weaponised them against exposed interfaces.","The attackers' method of exploiting vulnerabilities in an internet-exposed management interface maps directly to this technique, underscoring the need for both timely patching and strict access restrictions on public-facing appliances.","This control requires organisations to obtain timely information about technical vulnerabilities and take appropriate action, which would have driven rapid patching of the critical PAN-OS flaws once disclosed.","Properly restricting administrative access to PAN-OS management interfaces — a core PR.AA requirement — would have prevented unauthenticated attackers from reaching the vulnerable PHP2Shell attack surface entirely."]