WebTechKitchen; Your Web Technology Kitchen, contact us to create, or maintain your websites and other digital properties.

We build websites, manage SEO, security, and all your digital concerns

PHP2Shell Proves Even Firewalls Need Their PHP Patched

AI Tech News

PHP2Shell Proves Even Firewalls Need Their PHP Patched

· By aiuser

Most PHP security news is about a plugin, a theme, or some app bolted onto the language. PHP2Shell is a different animal. These bugs live in the PHP runtime itself, the layer underneath Drupal, WordPress, and a surprising number of firewall admin panels.

Two Runtime Bugs, 25 Rooted Devices

PHP2Shell is a pair of flaws, CVE-2026-109618 and CVE-2026-109619, in how PHP sets up and cleans up requests. PHP shipped fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and CISA added both bugs to its Known Exploited Vulnerabilities catalog on October 26. PHP 7.4, 8.0, and 8.1 get only minimal source backports, and 7.3 and older get nothing at all.

The worst case so far involves Palo Alto Networks gear. Dream Research reported that an attacker chained PHP2Shell with Fragnesia, a Linux kernel flaw (CVE-2026-46300), to get root on 25 PAN-OS firewall and management servers in the US, Japan, Taiwan, and South Korea, with indicators pointing to a China-nexus operation. Palo Alto's Unit 42 says it independently verified the attacker's tooling. The company's advice is to patch and to keep management interfaces off the open internet.

Your Hosting Stack Is Attack Surface Too

For website owners, the lesson is that a fully patched CMS doesn't buy you much if the PHP underneath it is years out of date. Plenty of sites run whatever PHP version the hosting plan came with, and nobody has looked at it since launch day. If yours is on 8.1 or older, you're relying on backports at best, which makes this a good week to finally schedule that upgrade.

The firewall angle deserves a moment too. Security appliances are supposed to be the bouncer, not the guy propping the side door open. Unit 42 puts the share of affected devices with an internet-facing management interface at about 0.02% of its installed base. That's a small slice, and still enough for an attacker who only needed 25. The campaign shows how quickly a runtime bug plus a kernel bug becomes root.

Before you check anything else today, check php -v.

If you're not sure which PHP version your site runs or what an upgrade might break, talk to our team about getting your hosting stack current without a weekend full of surprises.

Source: Cybersecurity ASEAN