PHP2Shell campaign hits Palo Alto firewalls, probes WordPress at scale

Key points

• PHP2Shell activity spanned the past seven days.
• Attackers obtained root access on Palo Alto firewalls.
• WordPress targeting did not result in successful exploitation.
• About 22.6 million instances remain in the exposed population.
• No CVE was assigned to the campaign.

Over the past week, a campaign tracked as PHP2Shell combined attempts to abuse weaknesses in PHP with targeting of WordPress and Palo Alto firewall appliances. The firewall intrusion reached root-level control, while the WordPress-focused exploitation did not succeed. No CVE has been assigned to this activity.

The affected population is broad: roughly 22.6 million instances are estimated to be exposed. That scale matters for K-12 and government environments because even a small success rate against perimeter devices can create disproportionate risk. Firewalls often sit at trust boundaries, so root access there can undermine segmentation and visibility.

The WordPress failure is a useful data point but not a reason to relax. PHP weaknesses remain relevant wherever web applications, plugins, or custom code are deployed. The absence of a CVE also complicates signature-based detection, making configuration review, integrity checks, and log hunting more important than waiting for a vendor advisory.

PHP2Shell's dual focus on firewalls and WordPress suggests opportunistic scanning across a large internet-facing estate rather than a single narrowly scoped exploit chain. Organizations should treat the firewall root compromise as the priority signal and review the past week of activity for unauthorized administrative changes, new accounts, or persistence mechanisms.

What to watch: unexpected firewall configuration edits, root-level logins, new scheduled tasks, and anomalous outbound traffic. On the web side, review PHP error patterns, WordPress authentication logs, file uploads, and plugin changes. Because the campaign is recent and no CVE is attached, teams should validate exposure and hunt for indicators rather than rely solely on patch status.

What to do now

1. Inventory all internet-facing Palo Alto firewalls and WordPress/PHP assets, prioritizing management interfaces and end-of-life components.
2. Check firewalls for unauthorized root-level changes, new accounts, configuration edits, and scheduled jobs; compare against a known-good baseline and isolate suspected systems.
3. Restrict firewall and WordPress administrative access to trusted networks, enforce MFA, and remove direct public exposure where possible.
4. Review the past week of firewall, web server, PHP, and authentication logs for PHP2Shell-related scanning, exploitation attempts, and anomalous administrative activity.
5. Patch PHP and WordPress core, themes, and plugins; remove unused components and enforce least privilege on web service accounts.
6. Hunt for webshells and persistence in WordPress uploads, plugin directories, and scheduled tasks; scan for unexpected files and outbound connections.
7. If compromise is suspected, rotate credentials and keys, rebuild affected systems from trusted images, and follow incident notification procedures.

Original source

SecurityWeek