PHP2Shell exploitation roots Palo Alto firewalls, but WordPress sites hold up

Threat actors have been attacking servers vulnerable to the PHP flaws dubbed PHP2Shell for more than a week, but confirmed compromises remain few, according to a SecurityWeek report published October 30.

The standout case involves Palo Alto Networks firewalls. A China-linked group chained exploits for the two PHP bugs with the Fragnesia Linux kernel privilege-escalation flaw to deploy webshells with root privileges, SecurityWeek reported. Dream Research flagged the campaign, saying at least 25 firewalls out of a pool of hundreds were hacked. Palo Alto Networks' Unit 42 said it independently verified the same attacker's tooling and confirmed the results.

Palo Alto Networks said it has patched the PHP flaws in PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 for PA-Series and VM-Series firewalls and for Panorama. It said no special configuration is needed to be affected, that exploitation targeted internet-exposed management interfaces, and that roughly .02% of its installed base had such exposure.

Mass attempts against PHP-based sites have been widespread but largely unsuccessful. Defiant said it had no knowledge of a WordPress site compromised this way as of October 28, despite over 77,000 related requests from more than 2,000 IP addresses. It noted exploits often need tuning to a target's build, extensions, memory limits and request handling.

Cato Networks said about 96% of blocked attacks targeted one of the two flaws, with healthcare the most-hit sector, and described the activity as opportunistic. WatchTowr reported successful exploitation from a single German IP that ran a simple curl command and stopped.

Defenders should restrict management interface access, apply vendor fixes, and keep PHP current.

CVE references

CVE-2026-109618

CVE-2026-109619