Chinese Hackers Exploit PHP2Shell Vulnerability in Palo Alto Networks Firewalls, Targeting Exposed Management Interfaces
What Happened — Attackers identified roughly 19,000 Palo Alto Networks firewalls with internet‑exposed management interfaces using the FOFA search engine. By probing the PAN‑OS version, they leveraged the recently patched PHP2Shell vulnerability to gain remote code execution on at least 25 servers across the United States, Japan, South Korea and Taiwan. In one U.S. government‑affiliated environment the group accessed Active Directory, indicating successful lateral movement. Palo Alto Networks released patches for all supported PAN‑OS versions except 11.1.7‑h12 (pending release). Until patches are applied, the vendor advises restricting management‑interface access to a dedicated jump box.
Why It Matters for Trust & Control Assurance — The incident underscores the need for robust vulnerability‑management and strict access controls around critical infrastructure, a single control that satisfies multiple framework requirements.
Who Is Affected — Enterprises and service providers that run Palo Alto firewalls with publicly reachable management ports, especially in technology, finance, government and critical infrastructure sectors.
Recommended Actions
- Deploy the latest PAN‑OS patches immediately and verify successful installation.
- Enforce a “jump‑box only” policy for firewall management traffic; block direct internet access.
- Continuously scan for exposed management interfaces and integrate findings into your change‑management workflow.
Technical Notes – The PHP2Shell flaw resides in the PHP interpreter embedded in PAN‑OS; exploitation yields remote code execution. No CVE identifier was disclosed, but Palo Alto’s security advisory confirms active exploitation. Source: DataBreachToday