Threat actors have been hammering servers vulnerable to PHP2Shell for over a week, but only a few successful compromises have been confirmed to date.
Standing out are Palo Alto Networks firewalls, which have been rooted by a China-linked hacking group in attacks chaining PHP2Shell with the Fragnesia kernel privilege escalation bug.
Assisted by AI, the hackers chained two separate exploits: one specifically targeting the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 on Palo Alto Networks’ PAN-OS devices, and another one for Fragnesia to deploy webshells with root privileges.
Cybersecurity outfit Dream flagged the campaign earlier this week, noting that at least 25 firewalls out of a pool of hundreds were hacked. Palo Alto Networks has since confirmed the findings.
“Dream Research has reported a campaign in which attackers chained PHP2Shell with a Linux kernel privilege-escalation vulnerability to gain root access. Unit 42 has independently verified the same attacker’s tooling and confirmed the reported results,” Palo Alto Networks said.
The company has rolled out patches that resolve the PHP2Shell flaws in PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 for PA-Series and VM-Series firewalls, and for Panorama (virtual and M-Series).
“No special configuration is required to be affected by this issue. Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet,” the company notes in its advisory.
Palo Alto Networks says that by default the management interface is not exposed to the internet and urges customers to immediately restrict access to it and apply the available fixes.
“Only a small fraction of a percent (approximately .02%) of our global installed base has internet-facing management interfaces configured and was impacted. Each of these customers has been individually contacted by our teams. We will continue to investigate and provide any necessary updates as they become available,” Palo Alto Networks notes.
22.6 million exposed PHP instances
According to the company, as of October 29, its telemetry has identified over 22.6 million exposed PHP instances that are potentially vulnerable to the PHP2Shell bugs.
That is not surprising, given that PHP is widely used across servers and content management systems, including WordPress, Drupal, Joomla, and many others.
The mass PHP2Shell exploitation has been targeting those as well, but remained largely unsuccessful, at least when it comes to WordPress, web security firm Defiant says.
As of October 28, it was not aware of any WordPress site being compromised via PHP2Shell exploitation, although it has recorded over 77,000 related requests from more than 2,000 IP addresses.
However, Defiant points out that testing has revealed the exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP build, running extensions, memory limits, and the server’s request handling.
“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.
A handful of IPs
Despite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.
According to Cato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.
The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.
According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.
The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.
WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.
“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.
“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.
Related: Fresh WordPress Vulnerability in Attackers’ Crosshairs
Related: Drupal Commerce Core Vulnerability Exploited Against Online Stores
Related: Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
Related: Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
