Threat actors hammered vulnerable servers to PHP2Shell for over a week, but only a few successful compromises have been confirmed to date.
Standout is Palo Alto Networks’ firewalls, which were rooted by a China-linked hacking group in attacks chaining PHP2Shell with the Fragnesia kernel escalation bug.
Aided by AI, the hackers chained together two separate exploits: one specifically targeting PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 on Palo Alto Networks PAN-OS devices, and another allowing Fragnesia to deploy webshells with root privileges.
Cybersecurity firm Dream reported on the campaign earlier this week, noting that at least 25 firewalls out of a pool of hundreds had been hacked. Palo Alto Networks has since confirmed these findings.
“Dream Research reported a campaign in which attackers chained PHP2Shell with a Linux kernel escalation vulnerability to gain root access. Unit 42 independently verified the same attacker’s tools and confirmed the reported results,” Palo Alto Networks said.
The company has deployed patches that address PHP2Shell vulnerabilities in PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 for PA-Series and VM-Series firewalls, as well as Panorama (virtual and M-Series).
“No special configuration is required to be affected by this issue. Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the Internet,” the company notes in its report. advisory.
Palo Alto Networks says that by default the management interface is not exposed to the Internet and urges customers to immediately restrict access and apply available patches.
“Only a small fraction of one percent (approximately 0.02%) of our global installed base has Internet management interfaces configured and has been impacted. Each of these customers has been contacted individually by our teams. We will continue to investigate and provide any necessary updates as they become available,” notes Palo Alto Networks.
22.6 million PHP instances exposed
According to the company, as of October 29, its telemetry has identified more than 22.6 million exposed PHP instances potentially vulnerable to PHP2Shell bugs.
This is not surprising, given that PHP is widely used on servers and content management systems, including WordPress, Drupal, Joomla and many others.
The massive PHP2Shell exploit also targeted them, but remained largely unsuccessful, at least as far as web security company WordPress is concerned. Defiant said.
As of October 28, the company is not aware of any WordPress sites compromised via PHP2Shell exploitation, although it has logged more than 77,000 associated requests from more than 2,000 IP addresses.
However, Defiant points out that testing has found that exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP version, running extensions, memory limits, and server request handling.
“Attackers continue to modify their tools. A successful attack could give them access to your site’s files, database and passwords, so updating PHP remains essential,” Defiant warned.
A handful of IPs
Despite numerous attempts to exploit PHP2Shell, success has been attributed to very few malicious actors.
According to Cato NetworksAbout 96% of blocked attacks targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the rest were invalid PoC or parsing attempts.
The attempts came from a handful of IPs in the US, Netherlands, and Germany, repeating proof-of-concept (PoC) type requests. Most of them focused on executing commands, followed by attempts at deserialization.
According to Cato, healthcare organizations were the most targeted, followed by technology and security services, professional services, automotive, education and nonprofits, as well as manufacturing, construction and retail.
The attacks were not targeted, however, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software industries on the same day.
WatchTowr claims to have observed successful exploitation of PHP2Shell from a single IP address in Germany, despite the large number of attempts and variety of payloads.
“In all cases, it runs a simple ‘curl’ command to prove the exploitation was successful, and stops there, with no additional post-exploitation activity,” said Jake Knott, manager of threat intelligence at WatchTowr.
“New techniques, inventive payloads, and better device-specific exploits are released as more reliable exploits are worked on, and we will likely only see public reporting of successful, highly targeted exploitation of specific edge devices continue to grow,” Knott added.
Related: New WordPress vulnerability in the crosshairs of attackers
Related: Drupal Commerce main vulnerability exploited against online stores
Related: Maximum severity GitLab vulnerability exploited against Alpine Linux
Related: Adobe, Veeam and Juniper Networks patch critical vulnerabilities
