Web servers and applications are witnessing a widespread wave of intense attacks targeting dangerous PHP2Shell vulnerabilities, amidst confirmations from cybersecurity companies that the rate of successful breaches remains very limited despite the massive volume of attempts.
In this campaign, Palo Alto Networks firewalls stood out, as a China-linked hacking group successfully breached a number of them by combining the exploitation of PHP2Shell vulnerabilities with the Linux kernel privilege escalation vulnerability known as Fragnesia to deploy malware with root privileges.
Details of Targeting Palo Alto Devices
Palo Alto Networks confirmed findings revealed by security entities, explaining that attackers utilized artificial intelligence tools to exploit the code vulnerabilities CVE-2026-109618 and CVE-2026-109619 in PAN-OS devices associated with management interfaces exposed to the internet. The company has issued urgent software updates to address the flaw in affected versions of the PA-Series and VM-Series firewall lines, as well as Panorama systems.
The company clarified that the default management interface is not exposed to the internet by nature, noting that a very small percentage estimated at about 0.02% of its global customer base was affected by these exposed interfaces, and the concerned customers were contacted directly to apply the necessary fixes.
Widespread Impact on PHP Servers and Failure Against WordPress
Telemetry data from the company showed that more than 22.6 million PHP installations are potentially vulnerable due to PHP2Shell vulnerabilities, given the widespread use of the language in content management systems such as WordPress, Drupal, and Joomla.
Despite the recording of thousands of scanning requests and attacks targeting platforms such as WordPress, the cybersecurity company Defiant confirmed that no successful breach cases against WordPress sites have been recorded to date, attributing this to the continuous need to modify exploits to match targeted server environments, memory settings, and PHP versions.
What Matters to System Administrators?
This campaign confirms that current cyberattacks increasingly rely on chaining multiple vulnerabilities to achieve full privileges in sensitive infrastructures. While most documented exploitation attempts by companies like Cato Networks focused on remote code execution (RCE) and targeted various sectors such as healthcare and technology, the minimal number of successful breaches emphasizes the importance of immediate updating and restricting direct access to management interfaces via the internet.