When we wrote about php2shell, the flaws in PHP itself, we warned that the list of places PHP runs is longer than anyone expects, and named network appliances among them. A week later, attackers proved the point on the one appliance a business trusts most: its firewall.
What happened
Dream's write-up reads like a methodical operation rather than a smash-and-grab. The attackers started with a search engine for internet-connected devices and found about 19,000 Palo Alto devices with their management page facing the internet. About 5,000 answered their version checks. They narrowed those to 240 targets running vulnerable versions in four countries.
The management web server on these firewalls runs on PHP, specifically PHP 8.0.30, a version that no longer receives security updates from the PHP project. That is what php2shell needed. The attackers used a custom exploit, built for that exact setup and not copied from any public one, to run code on the firewall as a low-privileged system user.
That alone was not enough: the firewall's own security controls blocked them from changing system files. So they used a second flaw, CVE-2026-46300 in the Linux kernel, nicknamed Fragnesia, to rewrite the system's login rules and become root, with full control of the device.
On 22 of the firewalls they planted a tiny web backdoor, 103 bytes long, and did nothing more that Dream could see. On a firewall in the US government-connected network they went further: a reverse tunnel set to restart automatically after a reboot, a proxy for routing traffic into the internal network, and attempts to create backdoor accounts in Active Directory. Dream says it is not known whether those accounts were created. Data likely taken there included a list of Active Directory users and groups, credentials, private keys and a map of the network.
Palo Alto says the affected customers, roughly 0.02% of its installed base with internet-facing management interfaces, were contacted individually. It has released fixed versions for every supported release of its firewall software, PAN-OS, and for Panorama.
The device you trust most
Firewalls, VPN gateways and remote-access appliances sit at the edge of the network by design. They have to be reachable, they are trusted by everything behind them, and they rarely run the security tools that would notice an intruder on an ordinary server. That makes them the most valuable foothold an attacker can get, and it is why so many of this year's serious incidents, at Ivanti, Cisco, Fortinet and now Palo Alto, have started at the edge.
The specific failure here is older than php2shell. A firewall's management page is for the people who administer it, and there is almost never a reason for it to be reachable from the whole internet. Palo Alto's own guidance has said so for years. The 240 targets in this campaign were the ones where that advice had not been followed.
There is also a lesson about what "patched" means. When PHP released its fixes on 21 October, nothing on these firewalls changed. Appliances carry their own copies of software like PHP, often older versions, and only the appliance vendor can update them. Your web host patching PHP does nothing for the PHP inside your firewall, your NAS or your phone system.
What to actually do
Find out whether your firewall's management page is on the internet. Ask your IT provider directly, or have someone test from outside your network. This applies to every brand, not only Palo Alto. If it is reachable, restrict it to your internal network, a VPN or a specific set of trusted addresses.
If you have a Palo Alto firewall or Panorama, update it. Install the fixed PAN-OS version listed for your release in Palo Alto's advisory. If your version is no longer supported, upgrade to one that is.
If the management page was exposed in October, check for compromise. Palo Alto has published detection guidance, and Dream has listed what the attackers left behind, including a backdoor file in the web interface's PHP directory and unexpected system services. If you find anything, treat the firewall as compromised: involve Palo Alto support, and change every password and key the firewall stored, including directory service and VPN credentials.
Ask the same question about every appliance. NAS devices, VPN gateways, printers, cameras and phone systems all have management pages, and many run PHP or similar software internally. None of them should face the internet, and each one should have someone responsible for its updates.
The summary
php2shell was announced as a flaw in websites. Its most serious confirmed damage so far was done to firewalls, because a firewall's admin page is a website too, running software its owner never sees and cannot patch alone.
The fix that would have prevented every one of these 25 compromises costs nothing: do not put the management page of a security device on the internet. If you are not certain yours is not, find out this week.
Sources
- Impact of critical vulnerabilities in PHP on Palo Alto Networks products — Palo Alto Networks
- Threat brief: critical vulnerabilities in PHP — Unit 42, Palo Alto Networks
- Chained php2shell exploit roots 25 servers — Dream
- php2shell: successful exploitation reports emerge — The Record
- China-linked hackers exploit php2shell to root firewalls — SecurityWeek
- php2shell attack roots 25 servers — The Hacker News
- php2shell one week later: why one exploit doesn't work everywhere — Tenable
- Known Exploited Vulnerabilities Catalog — CISA
