If your firewall's admin page can be opened from anywhere on the internet, the latest news is a direct warning. At the end of October, Palo Alto Networks confirmed that attackers are exploiting the PHP2Shell vulnerabilities against PAN-OS management interfaces exposed to the internet. Both ransomware operators and state-linked groups are reported to be using it.
Below we explain what PHP2Shell is, how the attacks work and how to check your own exposure, most of it in under an hour.
What PHP2Shell is
PHP2Shell is the name given to two critical flaws in PHP, the programming language behind a large share of the world's websites and many device admin pages. Tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10, both let a remote attacker run their own code on a server by triggering errors in the way PHP handles memory.
Palo Alto Networks' Cortex Xpanse service counted more than 22.6 million internet-exposed systems that are potentially vulnerable. PAN-OS, the operating system of Palo Alto firewalls, uses PHP in its web-based management interface, which is why firewalls became a target.
How the attacks work
Researchers at Dream documented one campaign in detail. The attackers used PHP2Shell to plant a web shell through exposed management pages, then chained it with Fragnesia (CVE-2026-46300), a Linux kernel flaw disclosed in May, to gain full root control. They rooted 25 servers and firewalls across the United States, Japan, Taiwan and South Korea, then extracted credentials from Active Directory domain controllers. Unit 42, Palo Alto's own research team, says it independently verified the attacker's tooling.
Security researcher Kevin Beaumont has also reported a ransomware group using PHP2Shell against Palo Alto firewalls to gain initial access to organisations, according to The Hacker News and Help Net Security.
There is some reassurance. Palo Alto says the management interface is not exposed to the internet by default, that only about 0.02% of its installed base had internet-facing management and was affected, and that devices running the available PAN-OS fixes are not affected.
The risk has grown since. Researchers at Hunt.io have found exploit code adapted specifically for PAN-OS circulating online. They note that PAN-OS runs the same PHP build on every unpatched device, which makes the attack far more reliable against these firewalls than against ordinary web servers.
The VMware ESX link: hiding the evidence
In the same week, CrowdStrike reported that a China-nexus group it calls Warp Panda exploited a VMware ESX flaw (CVE-2026-41709) as a zero-day to reduce what the hypervisor recorded in its audit trail. It is a separate campaign, but it follows the same playbook: break in through an internet-facing edge device, move to the virtualisation layer that runs the business's servers, then cut down the evidence.
Broadcom fixed the flaw in July 2026, and CISA added it to its catalogue of actively exploited vulnerabilities on 28 October. The lesson for defenders is simple: if the only record of an intrusion lives on a device the attacker controls, you may never know it happened.
How to check your own exposure
- Test from outside. From a connection outside your office, such as a mobile hotspot, try to open your firewall's management address in a browser. If the login page loads, it is exposed.
- Close it. Remove internet access to the management interface and limit it to trusted internal IP addresses or a dedicated management network, as Palo Alto's own best practices recommend. Manage remotely through the VPN instead.
- Update PAN-OS. Apply the fixed release listed in Palo Alto's advisory for your version. Fixes are now available for all supported branches, for example 12.2.4-h1 or later on PAN-OS 12.2. If you subscribe to Advanced Threat Prevention, confirm the related signatures are active. Industrial sites running Siemens RUGGEDCOM APE1808 devices, which use PAN-OS, should also follow Siemens advisory SSA-566512.
- Look for signs of compromise. If the interface was exposed before you patched, assume it may have been accessed. Review admin logins, configuration changes and unexpected files, and consider a professional compromise assessment.
- Reset credentials if in doubt. Rotate firewall admin passwords and the VPN and directory service account credentials the firewall uses, and check Active Directory for accounts you do not recognise.
- Patch VMware ESX and keep logs off the box. Update your hypervisors and send logs to a separate system that an attacker cannot alter.
- Don't forget your websites. PHP2Shell affects any server running unpatched PHP, not just firewalls. Ask your web host or developer to confirm your PHP version has been updated.
Closing thoughts
An admin page left open to the internet is usually a convenience decision made years ago, often by someone who has since moved on. Now it has become the way in. A five-minute test from outside your network will tell you whether it applies to you.
At COMMPRO Technologies, we supply and support next-generation firewalls across the UAE and GCC. Want a second pair of eyes on your firewall setup? Contact the COMMPRO team and we will help you check your exposure and plan the fix.
