php2shell Exploit Compromises Palo Alto PAN-OS Firewalls
Researchers confirmed the php2shell exploit chain has successfully compromised unpatched Palo Alto PAN-OS firewalls using two critical PHP vulnerabilities.
Hunt.io researchers confirm that php2shell, an exploit chain targeting CVE-2026-109618 and CVE-2026-109619, has rooted internet-facing Palo Alto PAN-OS firewalls in the first confirmed production compromises tied to the issue. Both bugs carry a CVSS score of 9.2 and were fixed on October 21, 2026, across PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
The first vulnerability is a use-after-free in PHP's out-of-memory path via longjmp(), while the second involves global state not resetting correctly across requests. A third entry, CVE-2026-115560, was opened on October 23 without technical detail, prompting cPanel to recommend disabling session.upload_progress. This default setting since PHP 5.4 writes attacker-controlled data into session files during multipart uploads. The exploit chain grooms the heap, leaks the libphp base address to bypass ASLR, and forges a destructor pointer so a later free calls system().
While watchTowr, 0x4D31, and GreyNoise logged exploitation on honeypots and sensors, Wiz observed mostly memory exhaustion, and CrowdStrike found no in-the-wild exploitation on October 23. However, PAN-OS management runs a uniform PHP 8.0.30 build on unpatched devices, making the exploit repeatable. Hunt.io located an open directory holding panos_rce_poc.py and prce.py. Dream Research documented a campaign paired with Fragnesia (CVE-2026-46300) to move from appweb to root, which Unit 42 verified. The attacker fingerprinted about 5,000 devices, targeted 240, rooted 24 firewalls, and compromised one internal firewall management server to reach 25 total compromises.