Palo Alto confirms PHP2Shell attacks

What Palo Alto confirmed

Palo Alto Networks published its advisory for the PHP2Shell flaws on 21 October 2026 and updated it on 29 October. The updated advisory states:

“Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.”

The advisory rates the issue 9.2 Critical with exploit maturity ATTACKED. It covers both CVE-2026-109618 and CVE-2026-109619, the pair tracked as PHP2Shell.

This is a vendor confirmation about its own product. It is not a victim count, and it does not identify the attacker or the affected customers.

What is exposed

The affected branches are PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, plus Panorama.

The exposure is the management web interface and XML API. A dataplane interface is affected only when a management profile is attached to it, and no special configuration is required for the management-path exposure. The risk is highest when the management interface is reachable from the internet.

Palo Alto lists GlobalProtect portal and gateway, Clientless VPN and captive portal as unaffected. Cortex XCORE (SaaS) was patched on 21 October and WildFire Cloud on 22 October.

Fixes and interim controls

The advisory lists fixed builds across the affected branches. Examples include 12.2.4-h1 and 12.1.7-h11, released on 27 October, and 11.2.16-h1, released on 28 October. Additional 12.1, 11.1 and 10.2 hotfixes are dated 25–29 October. Older unsupported releases need an upgrade to a supported fixed build, not an isolated patch.

The operational controls are the same ones this site has recommended for embedded PHP:

• Keep the management interface off the public internet.
• Restrict it to trusted internal addresses or a dedicated jump box.
• Where the management path cannot be closed, enable the listed Threat Prevention signatures, including Threat ID 543004, on content version 9162 or later. This requires routing management traffic through a dataplane port, replacing the inbound management certificate, decrypting inbound management traffic and enabling threat inspection.
• Review management logs for unexpected administrator logins or configuration changes.

What is confirmed and what remains open

On 29 October, Dream updated its report to name Palo Alto Networks PAN-OS as the affected firewall software and said it was collaborating with Palo Alto Networks. Unit 42’s 29 October update says it independently verified the same attacker’s tooling and confirmed the reported results.

The remaining limits are specific:

• Unit 42 does not itemize the 25 servers or publish victim names.
• The 25-server count remains Dream’s.
• Unit 42’s statement that about 0.02% of Palo Alto’s installed base had internet-facing management interfaces is a vendor characterization, not an independent victim count.
• Palo Alto’s advisory itself does not describe the Dream campaign or attribute the activity.

The practical conclusion does not depend on resolving those limits: internet-exposed PAN-OS management interfaces need the fixed build and access restrictions now.

The verification guide covers runtime checks. The mitigation guide covers the sequence when patching cannot happen immediately. The dossier keeps the CVE scope and source links together.