Palo Alto Networks warns of active PHP2Shell attacks on PAN-OS firewalls with remote code execution risk
Palo Alto Networks has confirmed that attackers are exploiting PHP2Shell flaws in internet-exposed PAN-OS management interfaces, enabling unauthenticated remote code execution on some devices while fixes for certain versions are still pending.
Active exploitation of serious flaws in Palo Alto Networks firewalls is exposing organisations that use the devices to the risk of full remote compromise.
Palo Alto Networks confirmed that attackers are targeting PHP2Shell vulnerabilities in internet-facing management interfaces of PAN-OS, the operating system that runs on its appliances. The flaws allow unauthenticated remote code execution, meaning an attacker can run commands on affected devices without valid credentials.
Multiple PAN-OS versions are affected, and some fixes are still pending, according to the report. That gap creates a window in which attackers can seize control of devices that haven’t been patched or properly isolated.
Because these firewalls sit at the edge of corporate and government networks, a successful exploit can give an intruder control over traffic inspection and security policies and provide a launch point into internal systems.
Immediate priorities for defenders include identifying any internet-exposed PAN-OS management interfaces, applying available patches, and restricting access to remaining vulnerable systems. How quickly patches roll out across installed devices, and whether incident responders start confirming breaches tied to these flaws, will show how far this campaign reaches.
Sources
- OSINT