October 29, 2026

Where PHP2Shell Reports and the Primary Sources Disagree

A man looking at a monitor in front of server racks

On October 29, 2026, reports appeared that firewalls had been compromised in attacks using the PHP flaw “PHP2Shell.” That is true. Palo Alto itself updated its own brief the same day to say it has confirmed exploitation.

But when I put the headlines and summaries next to the originals, some points did not match. This article checks those points against the primary sources. The information is as of October 29, 2026.

What is confirmed

Palo Alto Networks writes that PHP2Shell “is being actively exploited against PAN-OS management interfaces that are exposed to the internet” (Unit 42 threat brief, updated October 29).
Its advisory raised the severity to Critical and the urgency to Highest on October 27, and says active exploitation has been observed (Palo Alto advisory).
Dream reports that the attacker chained PHP2Shell with the Linux kernel flaw CVE-2026-46300 and got root on PAN-OS. It rooted 24 devices, then reached a management server through one of them, making 25 (Dream).
Palo Alto says it independently verified the same attacker’s tooling that Dream reported (Unit 42 threat brief).
On October 28, CISA added that kernel flaw to its Known Exploited Vulnerabilities (KEV) catalog. The note says it can be chained with PHP2Shell to run commands as root (I checked CISA’s KEV data directly).

Where the reports and the sources disagree

1. “25 servers in four countries”

One headline said, in effect, that 25 servers in four countries, including Japan, were compromised. In Dream’s report, the US, Japan, Taiwan and South Korea are the countries of the 240 devices the attacker targeted. In the part I checked, the report does not say that the 25 compromised devices were spread across four countries.

The source of the number differs too. The figure of 25 is Dream’s. JPCERT/CC’s alert gives no product name and no count. It lists the title of Dream’s article as a reference (JPCERT/CC, in Japanese).

2. “Firewalls everywhere are at risk”

According to Palo Alto, the affected devices were about 0.02% of its installed base: those with a management interface exposed to the internet. It says it contacted each affected customer individually. The management interface is not exposed by default (Unit 42 threat brief). That figure is Palo Alto’s own account and has not been independently verified.

It would also be wrong to read this as “only 12.1 and 12.2 are at risk.” Dream says those were the versions the attacker targeted. Palo Alto’s advisory lists fixes for 10.2 through 12.2 (Palo Alto advisory).

3. “The attack was written by AI”

Dream says it has no direct evidence that AI wrote the attack. It only suggests, from the structure of the code, that AI assistance is possible.

On October 23, Unit 42 added details on AI-driven post-exploitation activity, and retracted them on October 25. It could not confirm that the initial access at a European government agency was tied to the PHP2Shell CVEs (Unit 42 threat brief).

4. “A new kernel flaw”

CVE-2026-46300 is not newly found. It was already public in May, with write-ups saying it was being exploited (Qualys). What moved on October 28 was its listing in CISA’s KEV.

5. Early reports get corrected

In this one week, Sophos corrected, the same day, its October 23 report of a successful exploitation (Sophos). Unit 42 issued the retraction described above. The original that a report quoted may already differ from the original today.

What is still unknown

Dream could not tell whether the attacks on Active Directory credentials succeeded, from the artifacts it recovered. It says it cannot determine the full extent of the compromise.
I could not confirm a country-by-country breakdown of the 25.
I could not confirm fixed versions of CVE-2026-46300 for each Linux distribution.
The hotfix for PAN-OS 11.1.7 was listed with an ETA of October 30 as of October 29.

What to check in your own environment

If you do not use PAN-OS, you are not directly affected. If you do:

Check whether the management interface is exposed to the internet. If it is, take it off, and limit it to trusted internal addresses.
Find your version’s fixed release in the table on Palo Alto’s advisory.
Look for signs of compromise. Dream lists a web shell at /unauth/php/change_password.php and a directory /usr/local/lib/.panops/ (Dream).
If you suspect a compromise, bring in specialists such as Palo Alto’s Unit 42.

If you run PHP yourself, the steps are in For Anyone Who Has Not Updated PHP Yet. The technical details are in the engineer’s summary.

How to read the reports

When you see a number, check whose number it is: the reporter’s, a public body’s, or one the news outlet added. The weight changes with it. Check the update date of the original too. The notes section often says what is not known.