Palo Alto Networks has confirmed active PHP2Shell exploitation against exposed PAN-OS management interfaces and independently verified tooling from a campaign that reached root, persistence and Active Directory attack paths.
What changed
Treat any internet-exposed PAN-OS management interface that ran an affected build as a potential incident until evidence clears post-exploitation. Palo Alto Networks has confirmed active PHP2Shell exploitation against exposed PAN-OS management interfaces and independently verified tooling from a campaign that reached root, persistence and Active Directory attack paths.
Public record through 2026-10-30. Source references count citations across published briefings, including repeated sources. Explore the record and its limits →
What We Publish / What We Sell
D
Free · Public
The Daily
Five evidence-backed selections for security leaders, every weekday.
Executive decision priority across today's edition
Security.io score from 0–100, weighting Exposure, Urgency and Business Consequence equally. It ranks executive decisions, not technical severity; full evidence appears in each story's source ledger. PHP2Shell and PAN-OS: 97. KeyDrift and SD-WAN: 92. Florida aid breach: 89. iRhythm breach: 86. UNM Health recovery: 82. Focus the chart and use the up and down arrow keys for detail. Source: Security.io editorial scoring using the selected story source ledgers.