Hujumchilar Internetga ochiq Palo Alto Networks boshqaruv interfeyslaridagi PHP2Shell zaifliklaridan foydalanmoqda

Palo Alto Networks chorshanba kuni tahdid aktorlari yaqinda tuzatilgan PHP2Shell zaifliklaridan ommaviy foydalanish mumkin bo'lgan boshqaruv interfeyslariga qarshi foydalanayotganini ogohlantirdi.

"Internetga ochiq Palo Alto Networks boshqaruv interfeysiga qaratilgan faol ekspluatatsiya kuzatilgan", — deb aytdi tarmoq xavfsizligi kompaniyasi o'z maslahatiga yangilanishda.

CVE-2026-109618 va CVE-2026-109619 (CVSS ballari: 9.2) sifatida kuzatilgan zaifliklar hujumchilarga ta'sirlangan PHP versiyalarida ishlaydigan tizimlarda autentifikatsiyasiz masofaviy kod bajarishga imkon beradi. Muammolar PHP Foundation tomonidan 2026-yil 21-oktabrda 8.5.12, 8.4.27, 8.3.36 va 8.2.35 versiyalarida yuqori oqimda tuzatilgan.

Bu voqea Isroil kiberxavfsizlik kompaniyasi Dream bir necha kun oldin shubhali Xitoy bilan bog'liq tahdid aktori zaifliklardan Linux yadrosidagi mahalliy imtiyoz oshirish xatosi — Fragnesia (CVE-2026-46300, CVSS balli: 7.8) bilan birgalikda foydalanib, AQSh, Yaponiya, Tayvan va Janubiy Koreya bo'ylab 25 ta serverni root qilishini kuzatganidan keyin sodir bo'ldi.

Ular orasida AQSh hukumatiga tegishli muhitga tegishli uchta tizim ham bor edi.

"Ta'sirlangan qurilmalar yirik sotuvchining xavfsizlik devori dasturiy ta'minotining maxsus versiyalarini ishlatadi", — deb ta'kidladi Dream. "Keyin hujumchi Active Directoryga qarshi hujumlarni boshladi. Qayta tiklangan artefaktlar ma'lumot olish va katalogni tekshirishni tasdiqlaydi."

Dream ta'sirlangan xavfsizlik devori sotuvchisining nomini oshkor qilmagan bo'lsa-da, maslahat vaqti, shuningdek, boshqa tarmoq xavfsizligi kompaniyalari o'z mahsulotlariga qarshi zararli ekspluatatsiya haqida xabar bermaganligi, bu voqealar o'zaro bog'liq bo'lishi mumkinligini ko'rsatadi.

The Hacker News Dream va Palo Alto Networks bilan izoh olish uchun bog'langan va agar javob olsak, hikoyani yangilaymiz.

Bu voqea AQSh Kiberxavfsizlik va Infratuzilma Xavfsizligi Agentligi (CISA) CVE-2026-46300 ni Ma'lum Ekspluatatsiya Qilingan Zaifliklar (KEV) katalogiga qo'shishga undadi, federal agentliklardan 2026-yil 31-oktabrgacha tuzatishlarni qo'llashni talab qildi.

"Bu zaiflik CVE-2026-109618 va CVE-2026-109619 bilan birlashtirilib, PHP veb-qobiqlarini o'rnatish va buyruqlarni root sifatida bajarish mumkin", — deb aytdi CISA.

Palo Alto Networks shuningdek, bu muammo ta'sir qilish uchun maxsus konfiguratsiya talab qilinmasligini ta'kidlab, PAN-OS da xavf eng yuqori bo'lishini, boshqaruv interfeysiga kirish internetdagi tashqi IP manzillardan ruxsat etilganda ekanligini qo'shib qo'ydi.

"Bu muammo qat'iy ravishda boshqaruv veb-interfeysiga taalluqli, bu HTTPS veb-UI va XML API xizmatini o'z ichiga oladi", — deb aytdi u. "Bu ma'lumotlar tekisligi interfeysiga faqat unga boshqaruv profili biriktirilgan bo'lsa ta'sir qiladi."

PHP2Shell ta'sir qiladigan PAN-OS versiyalari quyidagilar:

• PAN-OS 12.2
• < 12.2.4-h1 (Tuzatilgan >= 12.2.4-h1)

• PAN-OS 12.1
• < 12.1.4-h13 (Tuzatilgan >= 12.1.4-h13) (ETA: 10/29)
• < 12.1.7-h11 (Tuzatilgan >= 12.1.7-h11)
• < 12.1.10-h3 (Tuzatilgan >= 12.1.10-h3) (ETA: 10/30)

• PAN-OS 11.2
• < 11.2.4-h23 (Tuzatilgan >= 11.2.4-h23) (ETA: 10/30)
• < 11.2.7-h23 (Tuzatilgan >= 11.2.7-h23)
• < 11.2.10-h16 (Tuzatilgan >= 11.2.10-h16)
• < 11.2.13-h4 (Tuzatilgan >= 11.2.13-h4)
• < 11.2.16-h1 (Tuzatilgan >= 11.2.16-h1)

• PAN-OS 11.1
• < 11.1.4-h38 (Tuzatilgan >= 11.1.4-h38)
• < 11.1.6-h40 (Tuzatilgan >= 11.1.6-h40)
• < 11.1.7-h12 (Tuzatilgan >= 11.1.7-h12) (ETA: 10/30)
• < 11.1.10-h36 (Tuzatilgan >= 11.1.10-h36)
• < 11.1.13-h16 (Tuzatilgan >= 11.1.13-h16)
• < 11.1.16-h4 (Tuzatilgan >= 11.1.16-h4)

• PAN-OS 10.2
• < 10.2.7-h39 (Tuzatilgan >= 10.2.7-h39) (ETA: 10/30)
• < 10.2.10-h42 (Tuzatilgan >= 10.2.10-h42) (ETA: 10/29)
• < 10.2.13-h27 (Tuzatilgan >= 10.2.13-h27)
• < 10.2.16-h12 (Tuzatilgan >= 10.2.16-h12)
• < 10.2.18-h13 (Tuzatilgan >= 10.2.18-h13)

Tuzatish versiyalari hali mavjud bo'lmagan PAN-OS versiyalari uchun Palo Alto Networks quyidagi yumshatish choralarini tavsiya qilgan:

• MGT porti uchun kiruvchi trafikni DP porti orqali yo'naltirish, masalan, boshqaruv kirishi uchun DP interfeysida boshqaruv profilini yoqish.
• Kiruvchi trafikni boshqarish uchun sertifikatni almashtirish.
• Boshqaruv interfeysiga kiruvchi trafikni shifrlash, shunda xavfsizlik devori uni tekshira oladi.
• Boshqaruv xizmatlariga kiruvchi trafikda tahdid oldini olishni yoqish.

"PAN-OS 12.2.4 va undan keyingi versiyalarda Frontier Virtual Patching (ATP Plus) bo'lgan mijozlar oldindan qamrov oldi, bu 2026-yil 20-oktabrda PT soat 22:21 da chiqarilgan Threat ID 543004 orqali taqdim etildi", — deb aytdi u.

"PAN-OS va Panorama'dagi bu muammo keltiradigan xavfsizlik xavfi boshqaruv interfeysiga kirishni faqat ishonchli ichki IP manzillarga cheklash orqali minimallashtiriladi, bu bizning tavsiya etilgan eng yaxshi amaliyot joylashtirish ko'rsatmalarimizga muvofiq."

Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces.

"Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet," the network security company said in an update to its advisory.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), allow attackers to achieve unauthenticated remote code execution on systems running affected versions of PHP. The issues were patched upstream by the PHP Foundation on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

The development comes days after Israeli cybersecurity company Dream said it observed a suspected China-nexus threat actor weaponizing the flaws in conjunction with a local privilege escalation bug in the Linux kernel, tracked as Fragnesia (CVE-2026-46300, CVSS score: 7.8), to root 25 servers across the U.S., Japan, Taiwan, and South Korea.

Among those were three systems belonging to a U.S. government-affiliated environment.

"The affected devices run specific versions of a large vendor's firewall software," Dream noted. "The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration."

Although Dream did not disclose the name of the affected firewall vendor, the timing of the advisory, combined with the fact that othernetwork security companies have not reported malicious exploitation against their products, suggests that these events may be related.

The Hacker News has contacted both Dream and Palo Alto Networks for comment, and we will update the story if we hear back.

The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the fixes by October 31, 2026.

"This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP web shells and run commands as root," CISA said.

Palo Alto Networks has also noted that no special configuration is required to be affected by this issue, adding the risk is highest on PAN-OS when access to the management interface is allowed from external IP addresses on the internet.

"This issue strictly affects the management web interface, which includes the HTTPS web UI and XML API service," it said. "It affects the dataplane interface only if a management profile is attached to it."

The following versions of PAN-OS are impacted by PHP2Shell -

• PAN-OS 12.2
• < 12.2.4-h1 (Fixed in >= 12.2.4-h1)

• PAN-OS 12.1
• < 12.1.4-h13 (Fixed in >= 12.1.4-h13) (ETA: 10/29)
• < 12.1.7-h11 (Fixed in >= 12.1.7-h11)
• < 12.1.10-h3 (Fixed in >= 12.1.10-h3) (ETA: 10/30)

• PAN-OS 11.2
• < 11.2.4-h23 (Fixed in >= 11.2.4-h23) (ETA: 10/30)
• < 11.2.7-h23 (Fixed in >= 11.2.7-h23)
• < 11.2.10-h16 (Fixed in >= 11.2.10-h16)
• < 11.2.13-h4 (Fixed in >= 11.2.13-h4)
• < 11.2.16-h1 (Fixed in >= 11.2.16-h1)

• PAN-OS 11.1
• < 11.1.4-h38 (Fixed in >= 11.1.4-h38)
• < 11.1.6-h40 (Fixed in >= 11.1.6-h40)
• < 11.1.7-h12 (Fixed in >= 11.1.7-h12) (ETA: 10/30)
• < 11.1.10-h36 (Fixed in >= 11.1.10-h36)
• < 11.1.13-h16 (Fixed in >= 11.1.13-h16)
• < 11.1.16-h4 (Fixed in >= 11.1.16-h4)

• PAN-OS 10.2
• < 10.2.7-h39 (Fixed in >= 10.2.7-h39) (ETA: 10/30)
• < 10.2.10-h42 (Fixed in >= 10.2.10-h42) (ETA: 10/29)
• < 10.2.13-h27 (Fixed in >= 10.2.13-h27)
• < 10.2.16-h12 (Fixed in >= 10.2.16-h12)
• < 10.2.18-h13 (Fixed in >= 10.2.18-h13)

For PAN-OS versions where fix versions are not yet available, Palo Alto Networks has recommended the following mitigations -

• Route incoming traffic for the MGT port through a DP port, e.g., enabling management profile on a DP interface for management access.
• Replace the Certificate for Inbound Traffic Management.
• Decrypt inbound traffic to the management interface so the firewall can inspect it.
• Enable threat prevention on the inbound traffic to management services.

"Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 and later versions received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on October 20," it said.

"The security risk posed by this issue on PAN-OS and Panorama is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.