Overview of PHP2Shell Exploitation Campaigns
Threat actors have been conducting widespread scanning and exploitation campaigns targeting servers vulnerable to PHP2Shell flaws. According to a report by SecurityWeek, the campaign relies heavily on automated scripts and proof-of-concept style requests originating from a limited pool of originating IP addresses. While millions of PHP instances globally remain exposed, successful compromises are currently concentrated on specific enterprise edge devices rather than generic content management systems like WordPress.
Technical Details and Attack Chain
Security researchers and vendor telemetry indicate that a China-linked threat actor group successfully achieved root access on a subset of internet-exposed Palo Alto Networks firewalls. This targeted compromise involved chaining the PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619 with the Fragnesia Linux kernel privilege escalation bug.
By combining these two distinct vulnerabilities, attackers were able to deploy persistent webshells with root privileges. Telemetry from Cato Networks revealed that approximately 96% of intercepted attack traffic targeted CVE-2026-109618, with nearly half of those requests attempting direct remote code execution. The remaining traffic consisted primarily of environment scanning and validation attempts.
Sector Targeting and Surface Area
Opportunistic scanning has affected multiple industry verticals, with healthcare organizations receiving the highest volume of attack traffic, followed by technology, security services, professional services, automotive, education, and manufacturing sectors. Despite tens of thousands of automated requests targeting various PHP environments, defenders and web security firms such as Defiant noted that WordPress installations largely resisted these automated exploits due to environmental variables such as Address Space Layout Randomization (ASLR), specific PHP builds, running extensions, and memory limits.
Palo Alto Networks confirmed that only a tiny fraction of its global installed base—approximately 0.02%—had their management interfaces improperly exposed to the public internet, making them susceptible to this specific attack chain. Each affected customer was individually notified by the vendor.
Actionable Remediation Steps
Defenders managing enterprise edge infrastructure and web application servers should prioritize the following mitigation strategies to neutralize potential compromise risks:
- Apply Vendor Patches: Upgrade PAN-OS software immediately to the latest patched versions provided by Palo Alto Networks for PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 across all PA-Series, VM-Series, and Panorama instances.
- Restrict Management Access: Ensure that device management interfaces are never directly exposed to the public internet. Enforce strict network segmentation, utilizing trusted internal jump hosts or VPNs for administrative access.
- Harden PHP Environments: Update all underlying PHP installations across web servers and content management systems to patch known execution flaws, and audit server configurations to minimize attack surfaces.
- Monitor Telemetry for Post-Exploitation: Review firewall logs and host-based monitoring solutions for anomalous curl commands, unexpected outbound connections, or unauthorized administrative privilege escalations.
Related: Zero-Day Exploitation: StyleSmuggler RCE in Magento, Adobe Commerce, PHP RCE Flaws CVE-2026-109618/109619 Actively Exploited