syslog.eu
CS EN DE FR
[CRIT · FIX TODAY]/News·

PHP2Shell roots Palo Alto firewalls with exposed admin pages: restrict access, look for web shells

Dream reports that a suspected China-linked attacker chained PHP2Shell, two PHP flaws, with the Fragnesia kernel bug and got root on 24 firewalls with internet-facing management across South Korea, Taiwan, Japan and the US on October 23–24. Dream withheld the vendor; The Register, via Mezha, says the devices run Palo Alto Networks PAN-OS versions 12.1 and 12.2.

Affected palo-alto pan-os php

Does this concern you?

  • Affected: a Palo Alto Networks firewall on PAN-OS version 12.1 or 12.2 whose management page loads from the internet (try it from a phone on mobile data), and your own servers running PHP.
  • Skip it if: neither applies. A management page that loads only from inside the office is not exposed.

What to do

  • Today, take the management interface off the internet: VLAN or VPN only.
  • Ask Palo Alto Networks which PAN-OS build fixes your version. The firewall carries its own PHP, so only vendor firmware fixes it.
  • If the page was reachable since PHP2Shell went public in the week of October 19, check the firewall, or have Palo Alto support check it, for unfamiliar PHP files in web-accessible directories and unexplained outbound SSH. Found one? Assume root and stolen stored passwords; we would change them all.
  • If the firewall logs users in via Active Directory, check the event logs for password spraying, LDAP queries from its service account and new accounts.
  • On your own servers, install the PHP fixes and the CVE-2026-46300 kernel update; on managed hosting, ask the provider.

What we know – and what we don't

  • Dream says the attacker's custom exploit, built for this platform's PHP 8.0.30, needs no login and reaches a root web shell in under 15 minutes.
  • Using FOFA, a search engine for exposed devices, the attacker found about 19,000 exposed firewalls, filtered them by version and country to 240 and rooted 24. On 22, only the shell stayed.
  • At one US government-affiliated organization the attacker tunnelled inside, rooted the firewall management server, decrypted the stored LDAP service account password and sprayed every Active Directory account; the domain had no lockout. Dream could not tell whether the spray found valid passwords.
  • Per The Register, Palo Alto's Unit 42 confirmed Dream's findings; vendor and versions rest on that report alone.
  • GreyNoise has seen at least six successful PHP2Shell exploitations; CISA lists the PHP bugs and Fragnesia as exploited. Experts cited by The Record expect most attacks to need a custom exploit.
  • Not known yet: which PAN-OS builds or PHP releases fix it; no article names them.

Why it matters

In our view, the trap is the checklist: patched PHP on web servers feels done, but few count the firewall as a PHP server. Dream says the attacker kept its 19,000 targets and can return. An admin page that loads from the internet is the part you control.

Sources

← All news