{"id":246089,"date":"2026-10-29T05:53:46","date_gmt":"2026-10-29T10:53:46","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/10\/attackers-exploit-php2shell-flaws-in-internet-exposed-palo-alto-networks-management-interfaces"},"modified":"2026-10-29T05:53:46","modified_gmt":"2026-10-29T10:53:46","slug":"attackers-exploit-php2shell-flaws-in-internet-exposed-palo-alto-networks-management-interfaces","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/10\/attackers-exploit-php2shell-flaws-in-internet-exposed-palo-alto-networks-management-interfaces","title":{"rendered":"Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces"},"content":{"rendered":"\n<p>Palo Alto Networks on Wednesday <a href=\"https:\/\/security.paloaltonetworks.com\/CVE-2026-109618\" target=\"_blank\">warned<\/a> that threat actors are exploiting the recently patched <a href=\"https:\/\/thehackernews.com\/2026\/10\/cisa-confirms-active-exploitation-of.html\" target=\"_blank\">PHP2Shell vulnerabilities<\/a> against publicly-accessible management interfaces.<\/p>\n<p>\u201cActive exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet,\u201d the network security company said in an update to its advisory.<\/p>\n<p>The vulnerabilities, tracked as CVE-2026\u2013109618 and CVE-2026\u2013109619 (CVSS scores: 9.2), allow attackers to achieve unauthenticated remote code execution on systems running affected versions of PHP. The issues were patched upstream by the PHP Foundation on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. \u201cActive exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet,\u201d the network security company said in an update to its advisory. The vulnerabilities, tracked as CVE-2026\u2013109618 and CVE-2026\u2013109619 (CVSS [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[418,1492],"tags":[],"class_list":["post-246089","post","type-post","status-publish","format-standard","hentry","category-internet","category-security"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/246089","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=246089"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/246089\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=246089"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=246089"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=246089"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}