China-Linked Attackers Exploit PHP2Shell Bugs in PAN Firewalls

Palo Alto Networks is reporting active exploitation of recently patched PHP2Shell vulnerabilities targeting internet-exposed management interfaces. These flaws enable unauthenticated remote code execution on vulnerable PHP and PAN-OS versions. Patches rolled out in late October, but numerous PAN-OS releases remain vulnerable across multiple version branches.

A China-nexus threat actor combined these PHP flaws with a Linux kernel privilege escalation bug to compromise approximately 25 servers across the U.S., Japan, Taiwan, and South Korea. Three of the affected systems belonged to U.S. government environments. The attack chain led to root-level access, followed by credential theft and directory enumeration against Active Directory infrastructure.

Federal agencies face a hard deadline of October 31 to patch the kernel vulnerability. Organizations should prioritize restricting management interface access to trusted networks and applying available patches. For systems awaiting fixes, Palo Alto recommends routing management traffic through data plane interfaces and enabling threat prevention on management services.