Attackers are targeting internet-exposed PAN-OS management services, the company says. It has released fixes for several branches and estimates releasing six more builds on October 29 or 30.
Palo Alto Networks warned on October 28 that attackers are actively exploiting PHP2Shell against its internet-exposed management interfaces. The US Cybersecurity and Infrastructure Security Agency (CISA) has also listed Fragnesia, a Linux flaw used alongside PHP2Shell, as actively exploited and says the combination can give attackers full control of vulnerable systems.
The warning follows the PHP Foundation’s October 21 patches for the underlying PHP flaws. Palo Alto Networks first published its advisory that day; fixes for some PAN-OS maintenance lines were still pending in its October 29 schedule.
CISA added Fragnesia, CVE-2026-46300, to its Known Exploited Vulnerabilities catalog on October 28 and ordered federal agencies to patch it, as detailed by BleepingComputer on October 29. The precise federal remediation deadline remains unclear.
Fragnesia affects the Linux kernel, the core of the operating system. It is a privilege-escalation flaw: an attacker who already has limited access can use it to gain root, the highest level of system access. This makes it a separate problem from the PHP flaws that provide the initial way into a system.
Fragnesia is a high-severity flaw. BleepingComputer reported on October 29 that a proof-of-concept exploit allows local attackers to gain root on major Linux distributions using kernels released before May 13, 2026.
CISA says attackers can combine Fragnesia with both PHP2Shell vulnerabilities to install PHP webshells—scripts that let an attacker send commands to a compromised server—and run commands as root. The agency has not disclosed further details of the Fragnesia attacks. Its warning means the response must address the kernel flaw as well as the PHP entry points.
The flaw lets attackers with valid credentials and network access to the PAN-OS management interface run code with full system privileges. Palo Alto Networks reports very limited exploitation and recommends upgrading affected devices.
3 min
PHP2Shell comprises CVE-2026-109618 and CVE-2026-109619, two critical PHP flaws with severity scores of 9.2 on the 10-point Common Vulnerability Scoring System. They allow unauthenticated remote code execution: an attacker can run chosen code over a network without logging in.
Palo Alto Networks says the affected service is the management web interface, including the HTTPS browser interface and the XML application programming interface used for software-based management. A dataplane interface—a port that carries network traffic—is affected only if a management profile is attached to it. No special configuration is required to be affected, but the company says the risk is highest when external internet addresses can reach the management interface.
The company’s fix schedule, detailed by The Hacker News on October 29, distinguishes released hotfixes from six builds with estimated release dates. Administrators should match their maintenance line to its fixed build; earlier builds in that line are affected.
| PAN-OS branch | Released fixed builds | Pending fixed builds and estimated dates |
|---|---|---|
| 12.2 | 12.2.4-h1 | None listed |
| 12.1 | 12.1.7-h11 | 12.1.4-h13 — October 29; 12.1.10-h3 — October 30 |
| 11.2 | 11.2.7-h23; 11.2.10-h16; 11.2.13-h4; 11.2.16-h1 | 11.2.4-h23 — October 30 |
| 11.1 | 11.1.4-h38; 11.1.6-h40; 11.1.10-h36; 11.1.13-h16; 11.1.16-h4 | 11.1.7-h12 — October 30 |
| 10.2 | 10.2.13-h27; 10.2.16-h12; 10.2.18-h13 | 10.2.10-h42 — October 29; 10.2.7-h39 — October 30 |
Cybersecurity company Dream said in its October 27 investigation that researchers discovered campaign artifacts on October 25 showing 25 compromised servers across the US, Japan, Taiwan and South Korea. Dream withheld the firewall vendor and affected software versions; its findings do not establish that the compromised devices were Palo Alto Networks products. It suspected links to China based on targeting, tools, infrastructure timestamps and Chinese-language prompts, but did not identify a named threat actor.
Dream said PHP2Shell initially gave the attacker access through a limited account, before Fragnesia provided root access. Three compromised servers were in a US government-affiliated environment. The attacker used compromised perimeter firewalls to build a tunnel into the internal network, configured it to reconnect after reboots, and reached an internal firewall-management server. Access to that server exposed the managed firewalls’ configurations, credentials and network settings.
From the management server, the attacker extracted a service-account password used to connect to Active Directory, the system holding the organization’s user and group records, and listed those users and groups. Dream could not determine whether later attempts to guess passwords, create backdoor accounts or extract keys used to sign login assertions succeeded. The full extent of the compromise therefore remained undetermined.
Palo Alto Networks says restricting management access to trusted internal IP addresses minimizes the risk on PAN-OS and Panorama. For PAN-OS versions without an available fix, it recommends configuring the firewall to inspect incoming management traffic through these steps:
The company says its attack-signature coverage requires a Threat Prevention subscription and the enabled Threat IDs listed in its advisory, supplied through Applications and Threats content versions 9162, 9163, 9164 and later. The signatures identify attack traffic; routing and decrypting management traffic allows the firewall to inspect it.
Palo Alto Networks says customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 and later received advance coverage through Threat ID 543004 at 10:21 p.m. Pacific Time on October 20.
Administrators awaiting a hotfix can check the Palo Alto Networks security advisory for release-status changes. The company says it will update the product-status table as more information becomes available.
