Our takeCISA added two PHP2Shell flaws in Palo Alto Networks management interfaces to its KEV catalog after confirming active exploitation for unauthenticated remote code execution. If you expose the interface to the internet, patch now and check for compromise.Security Resilience desk
Sources (3)
- hackernews · hackernews
- hackernews · hackernews
- the420_in · the420_in
What this means for you — Security leader:If you expose Palo Alto Networks management interfaces to the internet, disable internet exposure immediately and apply the PHP2Shell patches. Scan for webshells and signs of compromise.
What this means for you — Lean IT orgs:Check whether any of your internet-facing web servers or management tools run the affected PHP2Shell versions. Update them right away and turn off any unnecessary public access.
What this means for you — MSP:Audit all client Palo Alto Networks management interfaces for internet exposure and confirm the PHP2Shell patches are applied. Look for webshell activity across client environments.
What this means for you — Researcher:CISA added two PHP2Shell RCE flaws (CVSS 9.2) to the KEV catalog after observed exploitation targeting exposed Palo Alto Networks management interfaces.