PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

A China-linked threat group chained two PHP2Shell vulnerabilities with a Linux kernel privilege escalation flaw to gain root access to at least 25 Palo Alto Networks firewalls, demonstrating how unpatched vulnerabilities in critical network infrastructure can be combined for maximum impact. The attack succeeded because patches were available yet not applied in time, leaving internet-facing firewalls — devices whose primary purpose is protection — as the most exposed targets. With over 22.6 million vulnerable PHP instances still exposed, the attack surface remains enormous. This incident underscores that security appliances are not exempt from patching discipline and must be treated as high-priority assets in any vulnerability management program.