Palo Alto PAN‑OS Devices Under Active Attack via PHP2Shell Remote Code Execution Flaws
Palo Alto Networks says attackers are exploiting PHP2Shell vulnerabilities in internet‑exposed PAN‑OS management interfaces to gain unauthenticated remote code execution.
Live exploitation of vulnerabilities in widely deployed Palo Alto Networks firewalls is putting exposed systems at risk of remote takeover.
On 29 October, Palo Alto Networks confirmed that attackers are actively exploiting flaws known as PHP2Shell in its PAN‑OS operating system. The company said the vulnerabilities affect internet‑exposed management interfaces on multiple PAN‑OS versions and allow unauthenticated remote code execution, meaning an attacker can run commands on a device without valid login credentials.
Because these devices often sit at the edge of sensitive networks, compromise can have outsized consequences. An attacker who gains control of a firewall’s management interface can alter rules to open backdoors, disable security features, or use the device as a launching point into internal systems.
Palo Alto Networks has released patches for some affected PAN‑OS versions, but fixes for all versions are not yet available. Customers running releases without a patch must rely on temporary measures such as restricting which IP addresses can reach management interfaces or placing additional controls in front of vulnerable devices.
Security teams now face an urgent task: identify which PAN‑OS devices have management interfaces exposed to the internet, determine whether those devices are running affected versions, apply available updates, and enforce mitigations where patches are missing. Organizations with large or globally distributed firewall fleets may have to coordinate that work across multiple networks and administrators.
The incident underscores that security appliances themselves have become high‑value targets. Attackers focusing on devices that control network access can, in some cases, gain visibility into or influence over large volumes of traffic.
Signals to watch in the coming days include evidence of broad scanning for vulnerable PAN‑OS interfaces, reports of intrusions traced to these flaws, and the timeline for Palo Alto Networks to complete patch coverage across all affected versions. How quickly major enterprises and public‑sector users deploy fixes and mitigations will shape how much damage these PHP2Shell exploits ultimately cause.
Sources
- OSINT