Palo Alto Confirms PHP2Shell Attacks as Patch Routes Expand

The PHP fixes and the separate session issue

The emergency PHP releases fixed the original pair on 21 October. A separate session issue disclosed on 23 October still requires the configuration-specific response below.

The 23 October notice flags CVE-2026-115560 for possible remote execution. It requires all these conditions: upload progress remains enabled; session.serialize_handler is configured as php_binary or php_serialize; application code switches it to php using ini_set() before session_start(). Apply session.upload_progress.enabled=0 before request parsing, through the server configuration or FPM pool, and restart every worker until the regular bugfix and full advisory. Application-level ini_set() and FPM .user.ini apply too late for the confirmed session path. Retain an existing mitigation. Applications without runtime serializer changes can retain upload progress.

The original releases, 8.2.35, 8.3.36, 8.4.27 and 8.5.12, fix CVE-2026-109618’s failed-allocation cleanup and CVE-2026-109619’s request state surviving freed memory. Both permit execution without login and have critical 9.2 severity. Web-serving installations need fixes, with mod_php highest risk.

Use a supported branch or verified vendor backport. Emergency source changes do not renew support. Workarounds cover specific paths; only updating repairs the original pair.

Attempts observed, with clear limits

CERT-FR reported on 26 October that it was seeing attempts against the original pair on particular deployments. This establishes attempted exploitation, not a count of compromised organisations.

A 24 October honeypot report correlated 35 shell starts with execution requests across three deliberately exposed targets. They ran 8.4.26 with single-worker mod_php, a favourable profile for this chain. Some subsequent writes and downloads failed. These observations demonstrate execution on those decoys, not confirmed business victims or successful data theft, and do not establish exploitation of the new session issue.

WordPress observations have a narrower scope

Wordfence’s 28 October update says it knew of no WordPress compromise attributed to PHP2Shell. Its monitoring rule recorded roughly 77,600 related requests from more than 2,000 IP addresses during 23-27 October. Those requests show attempts, not whether they succeeded. Laboratory results varied with the PHP build, extensions, memory limits, request handling and address randomisation. That observation does not establish that unpatched WordPress servers are safe. Updating WordPress does not update its underlying PHP runtime; site owners still need the appropriate PHP fix and a restart.

31 October update: vendor corroboration of appliance compromises

Dream’s 26 October report, revised on 29 October, now identifies Palo Alto Networks PAN-OS. It describes attacks on 23-24 October, discovered on 25 October, that rooted 24 perimeter firewalls and one internal administration server; three were in an environment Dream describes as US government-affiliated. The chain combined the original PHP pair with kernel CVE-2026-46300, rather than the later session issue. The target list selected PAN-OS 12.1 and 12.2 systems running PHP 8.0.30. Recovered provisional exploit profiles do not establish successful compromises of every profiled build.

Dream reports persistent tunnelling to the internal server, extracted LDAP credentials and device private keys, and enumerated directory membership. Successful bulk password guessing, hidden-account creation and SAML signing-key extraction remain unknown. Chinese-nexus attribution remains provisional; observed AI tooling does not demonstrate generated exploit code. We have not independently examined the recovered victim artefacts.

In its 29 October update, Unit 42 says it independently verified the same attacker’s tooling and confirmed the reported results. It connects Dream’s campaign with active exploitation of internet-exposed PAN-OS management interfaces. The vendor advises removing public management access, restricting it to trusted internal addresses and applying PAN-OS fixes, which interrupt the observed chain. That prevents further use of this entry path; it does not establish that earlier persistent access or stolen credentials have been removed.

This is separate from Unit 42’s earlier report about a European government agency. It retracted that report on 25 October because it could not confirm PHP2Shell as the initial-access cause. The 29 October corroboration concerns Dream’s campaign and does not reinstate the earlier attribution of initial access.

Check what the firewall actually blocks

Cloudflare says its rule for the newer issue covers the default upload-progress field name; custom names fall outside that coverage. Paid managed rules must actually be deployed in blocking mode. Its response filtering can stop a matching reply reaching the requester after the server processes the request. A blocked reply therefore does not prove that no code ran. Keep runtime remediation separate from firewall coverage.

Where prompt deployment is impossible, CERT-EU advises considering public isolation. This remains a risk decision, not a blanket shutdown order.

Supplier packages: position checked on 31 October

For the original pair, Tenable’s notices identify SC-202610.2 for Security Center and the corresponding Enclave patch, updating the bundled interpreter to 8.2.35. The national bulletin retains SC-202610.1 labels in its references, but its revised solution directs readers to SC-202610.2.

The standalone release notes cover application versions 6.6.0, 6.7.2, 6.8.0 and 6.9.1 on Oracle Linux or Red Hat Enterprise Linux from version 8. The Enclave instructions instead map application 6.7.5, 6.8.0 and 6.9.1 to platform 1.7.0, 1.8.0 and 1.9.1 respectively. These installation paths for the pair require a service stop and restart, with distinct steps.

Synology’s matrix for the original pair names runtime corrections 7.4.33-0131, 8.0.30-0122, 8.1.34-0120, 8.2.35-0171, 8.3.36-0051 and 8.4.27-0051. It separately identifies Calendar 3.0.4-21435 and Mail Station 30000002.3.19-20333. The obsolete 7.3 branch will receive no fix. Hyper Backup is not listed in the current affected-products matrix; the omission is not a separate verified product assessment. Its low-risk assessment for the operating system’s built-in interpreter concerns that component’s lack of external exposure, rather than an exclusion for every package.

For the original pair, QNAP’s current table lists QTS 6.1.0.3656 or 5.2.11.3661; QuTS hero h6.1.0.3656, h6.0.2.3656 or h5.2.11.3661; and QuTScloud c5.2.9.3661, all with build 20261023. The same table routes QuTS hero h5.3.x to h6.0.2.3656. It also identifies QVR Surveillance 3.0.3.1756 for the affected ARM32 models and TVR OS 1.0.5. Notes Station is fixed in 3.9.15. ADRA is not listed in the current matrix; that omission alone does not establish a corrected ADRA build. Its guidance prioritises removing direct internet exposure; disabling the ordinary web server leaves management-interface exposure in place. Container and third-party runtimes require separate corrections.

Palo Alto Networks’ advisory updated on 29 October retains a Critical 9.2 rating for the original pair in PA-Series and VM-Series firewalls and virtual and M-Series Panorama. Management HTTPS and XML API services are affected; dataplane interfaces are exposed only when a management profile is attached. No special configuration is required for the vulnerability itself. Internet-reachable management carries the highest risk. GlobalProtect portal, gateway and Clientless VPN, and captive portal, are unaffected. The later session issue does not affect PAN-OS or Panorama; its impact on other products remains under review.

The vendor lists hotfix routes across PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2. Its 29 October advisory timeline records releases of 12.1.4-h13, 12.1.10-h3, 11.2.4-h23, 11.1.7-h12, 10.2.7-h39 and 10.2.10-h42. Match the installed maintenance line to the advisory’s route. The exception remains 11.2.10-h16, which fixes PHP, while 11.2.10-h17 also fixes Brotli. Older unsupported versions need migration to a supported fixed release.

Mitel’s revised assessment of the original pair includes additional affected communications applications, with other products still under investigation. It covers supported versions; retired products are not assessed. Unify Phone and CloudLink are listed as unaffected. Named fixes include SecurityPatch_R8.X_20 for MiVoice 5000; V11 R3.4.4 for OpenScape Branch and SBC; 9.4 or later for MiCollab Advanced Messaging; V2 R1.1.9 for OpenScape SESAP; and V8R0.13.0 for OpenScape Voice Trace Manager. Other rows still specify workarounds, planned updates or investigation. Use the affected-version row and its product-specific knowledge-base instructions; a general interpreter update is not verified appliance remediation.

For the original pair, Oracle’s separate PHP alert covers listed Communications products and Solaris. Its 26 October revision also adds Secure Backup, with affected versions 19.1.0.0.0 through 19.1.0.1.0. Follow each product’s patch-availability instructions; fixes cover releases under Premier or Extended Support, while older unsupported releases are not tested. These product-specific paths make the deployed component and its vendor correction part of the same containment decision.

Concerning the original pair, QNAP’s 22 October statement says it blocked attempts against its website, store and cloud services, with no evidence of related user-data access there. The product bulletin separately says it has received no exploitation reports targeting its products. Those are different scopes, neither a universal all-clear for customers’ devices.

The 26 October Windows package rebuilds, 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, also update Brotli to 1.2.1. The suffix denotes rebuilt dependencies, not a new PHP runtime version. The vulnerable decoder can be reached through cURL when automatic response decompression is enabled, including by an application or client library. Check that dependency route separately from the original PHP fixes.

Deploy, contain and verify

• Name an owner. Identify exposed applications, their runtime supplier and the person authorised to patch or restrict access.
• Agree the fallback. Decide which services can be isolated, what business functions will stop and who accepts that disruption.
• Require deployment evidence. Replace or restart existing workers, then confirm the running build against the published advisory. A downloaded package or hosting-provider promise is not proof of deployment.
• Validate recovery. Test essential transactions and inspect relevant logs before declaring normal service restored. Preserve suspicious evidence for investigation.

Ask managed-hosting suppliers for an explicit rollout and verification time. Do not assume an application update proves its underlying runtime has changed. Use the published guidance and recheck supplier coverage as packages roll out.