PANW · News · 20261030N

Security Product Vulnerabilities

Palo Alto Networks Inc · 2026-10-30 · Importance 34 · Surprise 42

A suspected China-linked actor reportedly exploited vulnerabilities in PHP2Shell and a Linux kernel privilege-escalation bug to gain root access to 25 Palo Alto Networks PAN-OS firewalls and management servers, including some linked to the U.S. government. The campaign, which began October 8, targeted entities in the U.S., Japan, Taiwan, and South Korea, and led to directory enumeration and credential theft. Palo Alto Networks issued patches and advised customers to restrict management-interface access to trusted IP addresses; CISA added the exploited vulnerabilities to its Known Exploited Vulnerabilities catalog.

Key facts

• A suspected China-linked actor chained PHP2Shell vulnerabilities with a Linux kernel privilege escalation bug to gain root access to 25 Palo Alto Networks PAN-OS firewalls and management servers, including some linked to the U.S. government. source
• An AI-enabled campaign targeting Palo Alto Networks firewalls began on October 8th and targeted entities in the U.S., Japan, Taiwan, and South Korea, resulting in directory enumeration and credential theft. source
• Threat actors had been attempting to exploit PHP2Shell vulnerabilities for over a week and successfully rooted Palo Alto Networks firewalls by chaining PHP2Shell with the Fragnesia kernel privilege escalation bug. source
• Palo Alto Networks issued patches and urged customers to restrict management interface access in response to PHP2Shell attacks. source
• Palo Alto Networks advised customers to restrict access to trusted IP addresses and apply relevant PAN-OS fixes. source