Palo Alto Networks says attackers are exploiting a serious flaw on firewall management pages exposed to the internet. Businesses should close access and patch.
Palo Alto Networks warned on Wednesday that attackers are actively breaking into its firewalls through a pair of serious flaws known as PHP2Shell. The attacks target the firewall's management page when it can be reached from the public internet. That page is the control panel that administrators use to run the device.
The two flaws sit in PHP, a widely used programming tool. Both are rated 9.2 out of 10 for severity. They let an attacker run commands on a system without a password. The PHP Foundation fixed them on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Palo Alto says no special setup is needed to be affected. The risk is highest when the management page accepts connections from outside IP addresses on the internet.
Days earlier, Israeli security firm Dream reported that a suspected China-linked group used these flaws to take over 25 servers in the U.S., Japan, Taiwan and South Korea. Three belonged to a U.S. government-affiliated environment. The attackers combined the flaws with a separate Linux bug called Fragnesia to gain full control, known as root access.
After that, Dream says, the attackers went after Active Directory, the system many companies use to manage staff logins. Recovered files showed passwords being pulled out and the directory being mapped. A firewall that is breached can become a way into the whole network.
Dream did not name the firewall maker. Still, the timing of Palo Alto's advisory, and the lack of similar reports from other security companies, suggests the events are linked. That is an inference, not a confirmed fact. The Hacker News has asked both companies for comment.
Palo Alto says the issue affects the management web interface, which includes its web dashboard and its XML API service. The firewall's traffic-handling side is affected only if a management profile is attached to it. The company says the risk is minimized when management access is limited to trusted internal IP addresses, which is its standard advice.
Customers on PAN-OS 12.2.4 and later with a paid add-on called Frontier Virtual Patching (ATP Plus) received early protection on October 20.
The alert box above lists the steps. The most urgent is making sure the management page is not open to the internet. Where Palo Alto has no fixed version yet, it has published temporary protections to use instead.
CISA, the U.S. cyber agency, added Fragnesia to its list of known exploited flaws. Federal agencies must apply fixes by October 31, 2026. CISA says it can be chained with the PHP2Shell flaws to plant hidden backdoors and run commands as root. Palo Alto has not yet released fixes for every affected version, so watch its advisory for updates.
If a Palo Alto firewall's management page can be reached from the internet, lock it to trusted internal addresses and patch now.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
