Cybersecurity outfit Palo Alto Networks has warned that hackers are actively exploiting the recently patched PHP2Shell vulnerability and targeting the company’s management interfaces. As a result, it has urged affected firms to patch their systems as soon as possible.
According to a security advisory published by Palo Alto Networks on Oct. 21 and updated Oct. 28, “Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.”
The company conducted an evaluation of its products to see how they were affected by the recent PHP2Shell exploit. As per a table included in the advisory, most Palo Alto Networks products appear to be unaffected. The key exception is its PAN-OS software, with versions 10.2, 11.1, 11.2, 12.1 and 12.2 all being susceptible.
The advisory also notes that although both Cortex XCORE (SaaS) and WildFire Cloud were previously impacted by PHP2Shell, they have since been patched, with updates released on October 21, 2026 and October 22, 2026, respectively.
Fixes and Mitigation Strategies
Palo Alto Networks said that “This issue will be fixed in the upcoming releases of PAN-OS.” Its product table now lists fixed builds for several versions, such as 12.2.4-h1, 12.1.7-h11 and 11.2.16-h1, with others due by Oct. 30.
Until the rest are patched, though, the advisory provides steps for organizations to secure their Palo Alto Networks’ management interfaces using the steps below.
First, Palo Alto Networks noted that “Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 and later versions received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20.”
Customers with a Threat Prevention subscription, on the other hand, can protect themselves by enabling the Threat IDs listed in the advisory, from Applications and Threats content version 9162 and later, the company explained.
For these Threat IDs to be able to protect your systems, you will need to first route incoming traffic for the MGT port through a DP port.
The Certificate for Inbound Traffic Management should be replaced, while inbound traffic to the management interface must be decrypted so that it is visible to the firewall. Threat prevention can then be enabled for the inbound traffic management services.
Palo Alto Networks also suggested that “The security risk posed by this issue on PAN-OS and Panorama is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.”
PHP2Shell Targets US Government-Affiliated Servers
The warning from Palo Alto Networks comes as researchers at Dream have detailed a suspected AI-assisted cyberattack that harnessed the same PHP2Shell exploit against 25 servers, including those affiliated with the US government.
According to Dream, the hacker in question combined the PHP2Shell exploit with a kernel privilege-escalation vulnerability (CVE-2026-46300). This focused on Active Directory and aimed at extracting user credentials and enumerating affected directories.
Dream hasn’t named a group behind the attack, and it didn’t name the firewall vendor, so it isn’t clear whether Palo Alto devices were involved. However, the company said multiple indicators point to a China-nexus operation, including traces of Chinese LLMs DeepSeek and Kimi, as well as API keys linked to the Chinese reconnaissance platform FOFA.
And because the attacker filtered their targets to focus on those from the US, Japan, Taiwan and South Korea, Dream believed that was an indication of “potential nation-state adversary efforts.”
For now, Dream said it had notified the affected firewall vendor. It then added: “As always, we recommend that organizations rapidly deploy relevant patches. Follow your vendor’s guidance for more information on this issue.”
