Active PHP2Shell exploits turn PAN‑OS firewall interfaces into targets for remote code execution
Palo Alto Networks says attackers are actively exploiting PHP2Shell vulnerabilities in internet‑exposed PAN‑OS management interfaces, allowing unauthenticated remote code execution on affected versions and forcing urgent defensive steps.
Attackers are exploiting serious flaws in the management software of widely used firewalls, according to vendor confirmation.
Palo Alto Networks has stated that PHP2Shell vulnerabilities in internet‑exposed PAN‑OS management interfaces are under active attack. These flaws allow unauthenticated remote code execution on affected devices, meaning an attacker can run commands on vulnerable systems without logging in, as long as they can reach the exposed interface. Multiple PAN‑OS versions are affected, and some still do not have fixes available.
Because PAN‑OS runs on firewalls and related appliances that sit at the edge of networks, successful exploitation gives intruders a powerful foothold. A compromised device can be used to inspect or reroute traffic, steal credentials, move deeper into internal systems, or disable other security controls.
Organizations that manage large fleets of these devices, including enterprises, governments, and service providers, face difficult triage choices while patches are incomplete. Short‑term options include taking management interfaces off the public internet, tightening access controls, and monitoring logs for signs of unexpected activity.
The confirmation that attackers are already abusing PHP2Shell exploits raises the stakes for incident response teams that must now check whether intrusions started before they were aware of the problem.
Key markers in the coming days will be the release of patches for all affected PAN‑OS versions, publication of detailed indicators of compromise that defenders can hunt for, and any major breaches publicly linked to use of these vulnerabilities.
Sources
- OSINT