PHP2Shell Attacks Target Palo Alto Firewalls
Palo Alto Firewalls
Threat actors are actively exploiting critical PHP vulnerabilities known as PHP2Shell to target Palo Alto firewalls. Millions of instances remain potentially exposed following more than a week of active attacks.
why this severityConfirmed exploitation in the wild against target devices.
- CVSS
- 9.8
- fix status
- No patch yet
- affected
- Palo Alto Firewalls
- first report
- 30 Oct 2026
- last update
- 30 Oct 2026
What to do
Apply available security patches or mitigation measures immediately.
Timeline · 1
Sources · 1
News and write-ups
- 2026-10-30PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressSecurityWeek · securityweek.com/php2shell-attacks-root-palo-alto-firewalls-but-fail-against-wor
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Patch now
- AI role
- No AI role
- categories
- General security
- severity
- 3 · Confirmed exploitation
- fix status
- No patch yet
- targets
- Not applicable
- owasp llm top 10
- no entry for these categories
- mitre atlas
- no technique for these categories
- dates
- happened 30 Oct 2026 · first reported 30 Oct 2026
- origin
- News & research feeds
- record
- confidence 0.95 · created 2026-10-30 18:43Z · updated 2026-10-30 18:43Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# PHP2Shell Attacks Target Palo Alto Firewalls https://gcdradar.vercel.app/incidents/php2shell-attacks-target-palo-alto-firewalls · AIR-2026-1674 · live - Lane: Patch now - Severity: 3 (Confirmed exploitation): Confirmed exploitation in the wild against target devices. - Fix status: No patch yet - First reported: 2026-10-30 - AI role: No AI role - Products: Palo Alto Firewalls - CVSS: 9.8 ## Summary Threat actors are actively exploiting critical PHP vulnerabilities known as PHP2Shell to target Palo Alto firewalls. Millions of instances remain potentially exposed following more than a week of active attacks. ## What to do Apply available security patches or mitigation measures immediately. ## Affected and fixed versions - Affected: Palo Alto Firewalls ## Latest updates - 2026-10-30: PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress (https://securityweek.com/php2shell-attacks-root-palo-alto-firewalls-but-fail-against-wordpress) ## Sources - 2026-10-30 SecurityWeek: PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress https://securityweek.com/php2shell-attacks-root-palo-alto-firewalls-but-fail-against-wordpress Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- liveDixell refrigeration units Multiple vulnerabilities discovered in Dixell refrigeration units
Patch now · Exploited · since 13 Nov 2026
- live8.6UnrealIRCd CVE-2026-114713: UnrealIRCd improper neutralization of delimiters vulnerability
Patch now · Exploited · Partly patched · since 13 Nov 2026 · CVE-2026-114713
- liveCity of Osaka municipal systems City of Osaka suffers data breach impacting one million residents
Breaches & attacks · Real loss · since 13 Nov 2026
- liveUniversity of Texas at Arlington discloses data breach from cyberattack
Breaches & attacks · Exploited · since 13 Nov 2026
- livePDF viewers Genuine PDF Forgeries: Attacking Signature Verification via Human Factors
Research · since 13 Nov 2026
- liveAMD SEV-SNP Mior and Skyfall Attacks Target AMD SEV-SNP VMs
Research · since 13 Nov 2026