Palo Alto Networks Warns of Active Exploits Targeting PAN-OS Firewalls via PHP2Shell Flaws
Palo Alto Networks has confirmed that attackers are actively exploiting critical PHP2Shell flaws in internet-exposed PAN-OS management interfaces, enabling unauthenticated remote code execution. Organizations that use the affected firewalls now face the prospect that core perimeter devices could be taken over before fixes are fully deployed.
Active exploitation of serious software flaws in widely used Palo Alto Networks firewalls has turned a newly disclosed issue into an immediate security problem for governments and companies.
On 29 October, Palo Alto Networks confirmed that attackers are abusing PHP2Shell vulnerabilities in internet-exposed PAN-OS management planes. These vulnerabilities allow unauthenticated remote code execution: anyone who can reach a vulnerable management interface from the internet can run commands on the device without logging in. Multiple PAN-OS versions are affected, and some fixes are still pending, which leaves a window in which even fast-moving defenders may stay exposed.
Firewalls running PAN-OS often sit at the edge of corporate and government networks, shaping traffic and separating internal systems from the wider internet. If an attacker gains control of the firewall itself, they can potentially monitor or modify traffic, install additional malware on internal systems, and create hidden access points for later use.
For security teams in hospitals, financial institutions, public agencies, and large private firms, that possibility forces a reassessment of their most trusted devices. Incident responders have to work on the assumption that configuration tools and logs on compromised systems may already be manipulated.
The timing is also difficult. Many organizations already struggle to keep up with patching, especially for core infrastructure where outages can disrupt critical services. Because the PHP2Shell flaws affect management interfaces, they touch the very part of the system administrators use to run and secure the rest. Where those interfaces are reachable from the wider internet for convenience or remote administration, attackers have a direct path that doesn’t require chaining multiple weaknesses together.
The nature of the bug makes it attractive to both financially motivated attackers and state-linked groups. Criminals can use it to plant ransomware, steal data, or sell access, while intelligence services may seek long-term footholds in sensitive networks. The fact that some affected versions do not yet have full patches increases the pressure on defenders, who have to rely on temporary measures such as restricting access to management interfaces or isolating devices.
The incident fits a broader trend of attackers going after core network equipment. A compromised firewall offers a vantage point over much of an organization’s traffic, which makes every other protective measure harder to trust until the device is secured.
The main signs to watch in the coming days are detailed technical advisories and patches for all impacted PAN-OS versions, evidence from independent researchers about how widely attackers are scanning for and exploiting the flaw, and any public attributions linking the activity to specific groups. How quickly major organizations can lock down their management interfaces will go a long way in determining the overall impact of this campaign.
Sources
- OSINT