Alerts
Active Exploitation of PHP2Shell Vulnerabilities Affecting Network and Security Products
3 November 2026
Active exploitation of PHP2Shell has been reported against Palo Alto Networks firewalls running affected PAN-OS versions. Attackers have also reportedly chained these vulnerabilities with a separate Linux kernel flaw to gain root privileges following initial compromise. As other vendors' products are also affected by PHP2Shell, organisations should check vendor advisories, apply security updates and secure management interfaces immediately.
Background
Palo Alto Networks has reported active exploitation of the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) targeting Internet-exposed management interfaces of firewalls running affected PAN-OS versions. More recently, attackers have been observed chaining the PHP2Shell vulnerabilities with a Linux kernel privilege-escalation vulnerability (CVE-2026-46300) to gain root privileges on compromised systems.
The PHP2Shell vulnerabilities also affect network and security products from other vendors, including Cisco, Citrix, F5 and Siemens.
Impact
Successful exploitation of these vulnerabilities could allow an unauthenticated remote attacker to execute arbitrary code on affected systems, potentially leading to unauthorised access and system compromise.
Known Exploitation
Active exploitation of PHP2Shell vulnerabilities targeting Internet-exposed management interfaces of Palo Alto Networks firewalls has been reported.
Security researchers have also reported that, following initial compromise through PHP2Shell in attacks against affected Palo Alto Networks firewalls, attackers exploited a separate Linux kernel privilege-escalation vulnerability, dubbed Fragnesia (CVE-2026-46300), to gain root-level privileges and conduct further malicious activities within affected networks.
Affected Products
The PHP2Shell vulnerabilities affect selected products from multiple vendors, including but not limited to:
Palo Alto Networks: PAN-OS running on affected PA-Series and VM-Series firewalls, and Panorama.
Cisco: Selected products, including Duo Access Gateway and Expressway Series.
Citrix: NetScaler ADC and NetScaler Gateway.
F5: BIG-IP APM and BIG-IP Configuration utility.
Siemens: RUGGEDCOM APE1808 devices running affected PAN-OS versions.
As the vulnerabilities affect products across multiple vendors, organisations should review their respective vendors' security advisories and apply available security updates to all affected products immediately. The list above is not exhaustive, and organisations should refer to vendor advisories for the full list of affected products and versions.
Recommendations
Users and administrators are advised to:
Review vendor security advisories to determine whether their products are affected and apply available security updates immediately.
Restrict access to management interfaces and administrative services to trusted networks and authorised administrators.
Investigate potentially compromised systems for indications of unauthorised access, privilege escalation, persistence and other malicious activities.
Continue monitoring vendor security advisories for updated information on affected products and mitigation guidance.
Organisations should also refer to CSA's earlier PHP2Shell Alert (AL-2026-151) for further information on the underlying vulnerabilities.
References