Palo Alto Networks has warned that attackers are exploiting the recently patched PHP2Shell vulnerabilities against management interfaces that are exposed to the internet. The company said, in an update to its advisory reported on Wednesday 29 October 2026: "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet." The warning narrows a broad patching story to a specific exposure: an internet-reachable management interface gives an attacker a direct place to try a known flaw.

What the flaws are, and what is fixed

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, each scored 9.2 out of 10. They can allow an unauthenticated attacker to run code remotely on systems running affected versions of PHP. The PHP project patched them on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

A separate report, kept separate

Palo Alto Networks has been releasing PAN-OS hotfixes in stages: three further hotfixes on 28 October, following four on 27 October, with some remaining fixes targeted for 29 or 30 October. A weekly roundup put the position at 14 of 20 hotfixes released by 28 October. Organisations still waiting for a build should restrict management access to trusted internal addresses.

Days earlier, Israeli security company Dream was reported to have observed a suspected China-linked actor using the PHP2Shell flaws with a Linux kernel flaw, Fragnesia (CVE-2026-46300), to gain root access on 25 servers. Dream did not name the firewall vendor involved, and any link to Palo Alto Networks is suggested by timing, not confirmed. This article does not claim the two reports describe the same attacks. The confirmed point is narrower: if a management interface is on the internet, patch it and restrict it now.

Sources: The Hacker News, TradingView / GuruFocus, Brandefense.