Palo Alto Networks Warns of Active PHP2Shell Exploits Allowing Remote Code Execution on PAN‑OS Devices
Palo Alto Networks says attackers are actively exploiting PHP2Shell flaws in internet‑exposed PAN‑OS management interfaces. The vulnerabilities allow unauthenticated remote code execution on affected devices, and some PAN‑OS versions still lack fixes.
Critical vulnerabilities in Palo Alto Networks’ PAN‑OS software have moved into active exploitation, turning a configuration choice that many administrators took for granted into a serious exposure.
Palo Alto Networks has confirmed that attackers are exploiting PHP2Shell flaws in internet‑exposed PAN‑OS management interfaces. The bugs enable unauthenticated remote code execution, so anyone who can reach a vulnerable interface over the internet can run commands on the device without valid credentials.
Because PAN‑OS runs on widely deployed security appliances, a successful exploit could give an intruder control over a system that sits at the edge of corporate or government networks. From that position, an attacker could alter how traffic is handled, hide malicious activity, or use the device as a launch point toward internal systems.
Multiple PAN‑OS versions are affected, and some do not yet have fixes available. Palo Alto Networks has started releasing patches and workarounds, but until those are applied and management interfaces are locked down, exposed devices remain high‑value targets. Many organisations leave these interfaces reachable from the public internet for convenience in remote administration, which now directly increases their risk.
Confirmation of active exploitation means security teams should assume that automated scanning and exploit attempts are already underway. Defenders need to do more than just apply updates: they also have to review logs and network behaviour to check whether attackers gained access before protections were put in place.
The incident shows how a remotely exploitable flaw in a core security platform can quickly become a systemic problem. When a single vendor’s edge devices are affected, attackers can reuse the same techniques across many different organisations.
Key signals to watch include more detailed technical write‑ups of the PHP2Shell vulnerabilities, reports tying specific intrusion campaigns to these flaws, and any follow‑up guidance from Palo Alto Networks on hardening management interfaces while patches are still rolling out.
Sources
- OSINT