PHP2Shell: two critical PHP flaws exploited, from WordPress sites to Palo Alto firewalls

PHP2Shell is the name given to two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that let an unauthenticated attacker run code on a server. CISA has confirmed their exploitation, and they have been chained with a Linux kernel flaw to take over Palo Alto Networks firewalls. Since PHP runs a large part of the web, including most WordPress sites, the fix is not just a job for network teams. Here is what we know, what is uncertain and what to do.

The flaws in brief

According to The Register and The Hacker News, both flaws are rated 9.2 out of 10 on the CVSS scale and allow code execution without authentication on a vulnerable PHP server. watchTowr details their nature: the first comes from memory corruption when PHP runs out of memory while setting up a request, the second from internal state that outlives the request’s memory, so the next request handled by the same worker can exploit that residual data. According to Prophet Security, the second can also leak worker memory, which may contain credentials and keys.

Any PHP installation serving web requests is affected (PHP-FPM, Apache mod_php, php-cgi, LiteSpeed, FrankenPHP). watchTowr rates the risk highest for Apache with mod_php, where the attack can succeed before the application’s code even runs. Prophet Security adds that Wiz demonstrated unauthenticated code execution against current WordPress, Drupal and Joomla container images, and that exploitation does not depend on a bug in the application’s own code: the exposure point is the PHP engine itself.

Timeline

According to The Register, AWS spotted exploitation attempts as early as October 17, four days before public disclosure. PHP fixes came out on October 21, with a CISA alert the same day, as Prophet Security detailed. Researcher Adel Karimi of Perplexity recorded 35 successful shell executions on October 24 on three honeypots, decoy servers, but he notes that his setup was favorable to the attack and not representative of a production server. CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog on October 26, with a deadline of October 29 for US federal agencies.

The scale is hard to measure. Also per The Register, Delft University’s threat intelligence lab counted more than 50,000 exploitation requests from more than 600 IP addresses in 70 countries, 171 of which sent exploit code or malware. But Sophos has since scaled its initial claims back to simple scans and failed attempts, and Palo Alto Networks withdrew the supposed link to an intrusion at a European government agency. CISA has not identified any compromised organization and does not confirm how many systems were hit.

Which PHP version to install

The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on October 21. As watchTowr explains, branches 7.4, 8.0 and 8.1 have no official fixed release: you need your distribution’s packages, PHP’s minimal source patches or an upgrade. PHP 7.3 and earlier have no fix. After updating, restart all PHP workers, because they keep running the old code until restarted. According to watchTowr, no configuration change fully mitigates these flaws.

Prophet Security also reports a third flaw, CVE-2026-115560, disclosed on October 23 and not fixed by the October 21 releases. It requires three specific conditions around session handling and upload progress, which makes it less widespread than the first two.

The attack on Palo Alto firewalls

The attack chain was described by security firm Dream. According to The Hacker News, an actor suspected of China ties combined PHP2Shell with a Linux kernel privilege-escalation flaw named Fragnesia (CVE-2026-46300, 7.8 out of 10) to gain root on 25 servers in the US, Japan, Taiwan and South Korea. The targets are PAN-OS management interfaces exposed to the Internet. Palo Alto Networks confirms active exploitation against those interfaces, while stating that customers who are patched or do not expose management are not affected.

The attackers then reportedly turned to Active Directory, with credential extraction and enumeration. Dream estimates that the attacker obtained the PAN-OS firmware, decrypted it, extracted the PHP libraries and tuned its exploit for nine software versions. According to Cybersecurity Dive, which cites Dream and Palo Alto’s Unit 42, the attacker appears to have been AI-assisted, with a platform named “aiscan” assembled from October 8, about 19,000 firewalls scanned on October 23 and a list filtered down to 240 targets.

• Attribution: the China lead is a hypothesis (“suspected”), not a certainty.
• US government targets: the link rests on clues (naming, CAC card authentication). Dream speaks of three US-government-affiliated servers according to The Hacker News, at least two according to Cybersecurity Dive, with no specific organization identified.
• Share of exposed firewalls: Xpanse puts the share of the installed base exposing management to the Internet at under 0.01% (The Hacker News), while a Palo Alto spokesperson cites about 0.02% (Cybersecurity Dive).
• Figures: 25 servers, 240 targets or 19,000 scans come from Dream, Palo Alto or the articles, with no independent verification.

On the vendor side, The Hacker News says Palo Alto announces fixes for all vulnerable PAN-OS versions as of October 30. The GlobalProtect portal and gateway are not affected. CISA added Fragnesia to its KEV catalog on October 28, with a deadline of October 31 for federal agencies.

Other affected products

Prophet Security also lists Citrix NetScaler management interfaces (fixes released on October 27) and Cisco Expressway and related products, some of whose fixes are still pending. FortiOS is listed as not affected. The Hacker News notes that Cisco and Fortinet published advisories without reporting malicious exploitation. In its weekly roundup, This Week in Security also mentions 25 compromised servers, including at least one tied to the US government.

What to do

Here are the steps, in priority order:

1. Update PHP to the fixed version of your branch, then restart all PHP workers. If you are on a branch with no upstream fix (8.1, 8.0, 7.4), use your distribution’s packages or migrate.
2. On a WordPress site, check the PHP version under Tools, then Site Health, Info tab. If your host manages PHP, ask it to confirm it has deployed the fixes and restarted.
3. If you cannot update right away, interim measures exist, but they are no substitute for the fix: disable session.upload_progress.enabled and restart workers, tighten upload size limits, block multipart/form-data on applications that accept no file uploads. Also restrict Internet access to the affected system, as PHP recommends.
4. On PAN-OS, take the management interface off the Internet, limit it to trusted internal addresses and apply the fixes for the branch you use.
5. Look for traces since October 17: unusual multipart requests to pages that never receive files, memory errors (“Allowed memory size of”) or PHP worker crashes (signal 11), and above all PHP processes spawning shells or download tools. Also check for new files in the web root, cron jobs and added admin accounts.

According to Prophet Security, if a check hits, the machine should be treated as compromised until an investigation says otherwise: preserve logs, rotate every credential the web server account could read (including database passwords) and rebuild from a patched image rather than cleaning in place.

Frequently asked questions about PHP2Shell