Palo Alto Networks has alerted the cybersecurity community about active exploitation of PHP2Shell vulnerabilities by threat actors targeting publicly accessible management interfaces. These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have CVSS scores of 9.2 and enable attackers to execute remote code without authentication on systems running certain versions of PHP. The PHP Foundation addressed these issues with patches released on October 21, 2026, for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

The situation escalated as Dream, an Israeli cybersecurity firm, reported a suspected China-based threat actor using these PHP2Shell flaws alongside a Linux kernel privilege escalation vulnerability termed 'Fragnesia' (CVE-2026-46300) to compromise 25 servers in the U.S., Japan, Taiwan, and South Korea. Among the affected systems were three associated with a U.S. government-affiliated network. The attackers exploited specific firewall software versions to infiltrate Active Directory, extracting credentials and conducting directory enumeration.

In response, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog, mandating that federal entities apply necessary fixes by October 31, 2026. Palo Alto Networks stresses that systems are vulnerable if the management interface is accessible from external IP addresses. To mitigate risks, they recommend restricting management interface access to trusted internal IPs.

Palo Alto Networks has proactively contacted potentially affected customers whose systems have internet-exposed management interfaces. They assure that those who have applied the patches or follow best practices to secure management interfaces remain unaffected. The company continues to monitor the situation closely and promises further updates as needed.