Update, Oct. 30: Palo Alto's advisory, last revised Oct. 29, now lists all of its PAN-OS hotfixes for the PHP2Shell flaws as released, so no fix builds remain pending. It still lists no indicators of compromise.
Palo Alto Networks now says attackers are actively exploiting the PHP2Shell flaws against firewall management interfaces exposed to the internet, according to the company's security advisory for CVE-2026-109618. The shift matters for any organization that runs Palo Alto firewalls: the administrative interface that controls a network's security rules is now a confirmed target.
What Happened
PHP2Shell is the nickname for two flaws in PHP, the programming language behind much of the web, that can let an attacker run code on a server without logging in. PHP's maintainers released fixes Oct. 21. Palo Alto's PAN-OS operating system uses PHP in the web-based management interface of its PA-Series and VM-Series firewalls and its Panorama management consoles.
The advisory now states that active exploitation has been observed against management interfaces reachable from the internet and lists the exploit's status as "attacked." On Tuesday, Palo Alto raised the issue's severity to Critical, with a score of 9.2 out of 10, and its urgency to Highest. Earlier versions rated it High at 8.7 and said the company was not aware of malicious exploitation against its products, Help Net Security reported Oct. 22.
The advisory does not say when Palo Alto first saw the attacks. It lists no indicators of compromise, the digital traces defenders use to check whether they were breached, and it does not describe the attackers or any victims.
Palo Alto shipped hotfixes in stages starting Oct. 25, and its advisory now lists fixes for every affected PAN-OS version.
Why It Matters
A firewall is the gatekeeper at the edge of a corporate or government network. Control of its management interface could let an intruder change the rules that decide what traffic gets in and out. The risk depends heavily on exposure: Palo Alto scores the flaw 7.7 instead of 9.2 for customers who allow management access only through a single tightly controlled "jump box" computer.
That makes the immediate step an inventory question for executives: is any firewall or Panorama management page reachable from the internet? Palo Alto's advice is to restrict management access to trusted internal addresses. Customers with its Threat Prevention subscription can also enable attack signatures, though the advisory says that requires routing management traffic through a separate inspected port.
The government has already acted on the underlying PHP flaws. The Primary Wire reported Tuesday that the Cybersecurity and Infrastructure Security Agency (CISA) added both to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies until Oct. 29 to act.
What to Watch
The key gap is detail. Watch whether Palo Alto or its Unit 42 research group publishes indicators of compromise or describes the attacks. Unit 42 has already withdrawn one account: as The Primary Wire reported, it retracted a report linking an intrusion at a European government body to PHP2Shell.
Also watch whether CISA issues guidance aimed specifically at firewall owners. A third PHP flaw, which PHP has not yet fixed, does not affect PAN-OS because the software does not use the configuration involved, Palo Alto says.
