Active exploits hit Palo Alto Networks PAN‑OS flaw that allows remote takeover of firewalls
Palo Alto Networks confirms that attackers are exploiting PHP2Shell vulnerabilities in internet-exposed PAN‑OS management interfaces, enabling unauthenticated remote code execution. Multiple versions are affected and some fixes are still pending, turning core security appliances into potential entry points for intruders.
A critical software flaw in Palo Alto Networks devices is under live attack, opening a path for intruders to seize control of hardware many organisations rely on as their first line of defence.
Palo Alto Networks has confirmed that attackers are actively exploiting PHP2Shell vulnerabilities in internet-exposed management interfaces running its PAN‑OS operating system. The weaknesses allow unauthenticated remote code execution, so an attacker can run commands on a vulnerable device without logging in. Multiple PAN‑OS versions are affected, and some do not yet have patches available, according to security reporting on 29 October.
Because the bugs hit the management plane and are reachable from the public internet, they represent some of the most serious types of flaws in firewall software. Once attackers gain code execution on a device, they can potentially monitor or alter traffic, move deeper into internal networks, plant backdoors, and tamper with logs to hide their activity.
Palo Alto Networks supplies network security equipment to governments, financial institutions, telecom operators, cloud providers, and many large companies. That customer base makes remotely exploitable vulnerabilities in its products a high-value target for criminal groups and state-linked actors. Confirmation of active exploitation indicates that at least some threat actors are already scanning for exposed systems and attempting to compromise them.
For security teams, this turns a core defensive asset into a possible weak point until patches are applied and thorough checks are completed. Attackers who move quickly may be able to establish persistence that survives later updates if they install additional malware or create covert administrative access.
The situation fits a broader pattern in which firewalls and other edge devices are priority targets because they sit at the boundary between the internet and internal networks. Compromise of a single unpatched appliance at a large organisation can yield the sort of access that previously required a long intrusion campaign.
The timing of exploitation relative to patch availability also matters. When attackers have working exploits while some product versions remain without fixes, there is a window in which they can work through lists of exposed devices faster than many defenders can respond.
Key developments to watch include any alerts from national cybersecurity agencies, updates from Palo Alto Networks on patch coverage for all affected PAN‑OS branches, and incident reports from organisations that find evidence of compromise on their devices. Those details will give a clearer sense of how widely the PHP2Shell campaign has spread and which sectors are most at risk.
Sources
- OSINT