Palo Alto Networks Confirms Active Exploits of PHP2Shell Flaws in PAN‑OS Firewall Management Interfaces
Palo Alto Networks says attackers are exploiting PHP2Shell vulnerabilities in internet-exposed PAN‑OS management interfaces, using unauthenticated remote code execution flaws against multiple software versions while some fixes are still pending.
Palo Alto Networks has confirmed that attackers are actively exploiting PHP2Shell-related flaws in its PAN‑OS software, targeting internet-exposed firewall management interfaces.
On 29 October, the company said that threat actors are using PHP2Shell vulnerabilities in PAN‑OS management interfaces that are reachable from the internet. The flaws allow unauthenticated remote code execution, so an attacker can run commands on a vulnerable device without logging in.
Multiple PAN‑OS versions are affected. Fixes are available for some versions, while patches for others are still pending, according to current security reporting.
Because the attacks focus on the management interface of PAN‑OS devices, a successful exploit can give intruders control over systems that organisations rely on to enforce network security policies.
The confirmation that exploitation is already underway means defenders need to treat unpatched, internet-exposed PAN‑OS management interfaces as high-risk entry points rather than theoretical vulnerabilities.
Key signals in the coming days include updated mitigation guidance from Palo Alto Networks, publication of indicators of compromise security teams can use to detect past breaches, and evidence from incident responders about which sectors and regions are most heavily targeted.
Sources
- OSINT