Reports of real-world attacks using the PHP2Shell vulnerabilities have emerged, with one security firm describing a campaign that chained them with a Linux flaw to take over internet-facing firewalls.
Two PHP vulnerabilities disclosed earlier this month, CVE-2026-109618 and CVE-2026-109619 and known together as PHP2Shell, are now being used in attacks. The Record reported on 29 October 2026 that threat-intelligence firm GreyNoise had seen at least six successful exploitations.
The US Cybersecurity and Infrastructure Security Agency (CISA) added the PHP2Shell bugs to its Known Exploited Vulnerabilities catalog this week. It also added CVE-2026-46300, a Linux flaw, on 28 October.
Attacks on firewalls
Security firm Dream described a suspected China-linked campaign that combined PHP2Shell with the Linux flaw. PHP2Shell alone gave the attackers the ability to run commands; the second bug let them take full control of the device. Dream reported 24 compromised firewalls, most of them attacked on 23 and 24 October, after the attackers scanned the internet for exposed devices.
Dream later said the affected firewalls were from Palo Alto Networks. According to the report, Palo Alto Networks' Unit 42 verified the findings and released a fixed version of the PAN-OS management web server.
Experts quoted by The Record warned that the same scanning approach could be used against other types of devices, and that end-of-life equipment exposed to PHP2Shell should be replaced quickly.
This article summarizes and comments on the source above in our own words. NC Solution is not affiliated with the source; read the original for full details.