PHP2Shell RCE and Palo Alto VPN Flaw Demand Immediate K-12 Action

Critical PHP RCE CVE-2026-109618/109619 and Palo Alto GlobalProtect CVE-2026-0257 exploited; K-12 patch, scan, hunt.

  • Emergency PHP updates for CVE-2026-109618 and CVE-2026-109619 are already being probed; an open-source scanner can find exposed hosts.
  • Ransomware groups have exploited Palo Alto GlobalProtect CVE-2026-0257 since June, targeting education and government sectors.
  • K-12 impact: internet-facing CMS, VPN gateways, backups and vendor integrations are at risk; patch, scan and hunt now.

What to do now

  1. Inventory all internet-facing PHP, Apache mod_php, PHP-FPM and PAN-OS GlobalProtect instances; record versions, owners and exposure.
  2. Apply the PHP emergency fixes for CVE-2026-109618 and CVE-2026-109619 and the Palo Alto fix for CVE-2026-0257; restart PHP-FPM/Apache and verify the patched version is active.
  3. Run Searchlight Cyber's php2shell-scanner against external and internal hosts; deploy WAF/virtual patching and restrict admin interfaces and VPN access while patching completes.
  4. Review web, PHP-FPM, CMS, VPN and authentication logs for webshells, unexpected child processes, anomalous VPN sessions and new devices; terminate suspicious sessions and rotate credentials.
  5. Revoke UpdraftCentral keys if used, isolate and test offline backups, and rebuild any host with confirmed compromise rather than attempting cleanup.

Related items