PHP2Shell One Week Later: Honeypot Shells on the Web, a Path to Root on Palo Alto Firewalls

    Wednesday, November 4, 2026 In: Threat Research Print

    Date: 11/04/2026

    Severity: High

    Summary

    PHP2Shell exploits two critical PHP memory-safety vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that can enable remote code execution on vulnerable systems. Further investigations uncovered 616 PHP2Shell-related files, including exploit kits, custom tools, scanners, and post-exploitation utilities. While reliable mass exploitation remains unconfirmed, attackers have adapted the exploit chain to target PAN-OS firewalls and successfully gained root access on internet-facing devices. High-value targets, including government agencies, banks, telecom providers, and universities, have also been observed in attackers' targeting activity. The findings highlight the growing exploitation risk and the need to patch vulnerable PHP versions and monitor suspicious activity.

    Indicators of Compromise (IOC) List

    IP Address

    162.35.99.94

    15.204.59.70

    2.59.133.151

    208.115.245.98

    208.115.245.99

    208.115.245.102

    185.242.106.140

    45.39.190.176

    130.94.67.235

    45.83.180.113

    15.204.59.70

    162.35.99.94

    85.121.179.129

    34.146.20.31

    38.60.136.217

    96.126.130.81

    101.133.233.159

    144.217.161.236

    152.42.245.8

    23.27.25.75

    130.12.180.89

    45.225.135.53

    Hash

    535b9e298defd3449ba2b10b9828925d3ce344872dcbd9470c0e8db20f0aae83

    6f84cc354b785157983efa8f4b674d2e1d6c3331017f29ff8d51bc43668d4b0f

    2d692ee6dcb41c249c55881897b7dec0550b92963e07fccdb11ad655601977c3

    66bcbc8c2b9d847a1e976e57972e10eac98e9b894cbf30510bff1e8d63efb81f

    1c93ea48fa7ff886a6d81e44869dd7962309e95d01c1561df362b0b18007a562

    9c15dc5a510bf2e8a16c846e61fa35c50ef733b72d4e47b6e8307498a398443c

    4a1502affa36d106d5374bf02cf777956eef651176ec8964b26ff90f103dd506

    c1e81cfbaf7e4cccad7d7f43c1a624b791ba1b7f1d176e224455138604837b4c

    5e99d6023dce9bb18d845a37fcdbc7ea574fdb20ab8d888ec54c695382d46036

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection    

    Detection Query 1 :

    dstipaddress IN ("45.225.135.53","208.115.245.99","38.60.136.217","85.121.179.129","45.83.180.113","130.94.67.235","34.146.20.31","144.217.161.236","208.115.245.102","101.133.233.159","152.42.245.8","185.242.106.140","96.126.130.81","130.12.180.89","45.39.190.176","208.115.245.98","15.204.59.70","2.59.133.151","23.27.25.75","162.35.99.94") or srcipaddress IN ("45.225.135.53","208.115.245.99","38.60.136.217","85.121.179.129","45.83.180.113","130.94.67.235","34.146.20.31","144.217.161.236","208.115.245.102","101.133.233.159","152.42.245.8","185.242.106.140","96.126.130.81","130.12.180.89","45.39.190.176","208.115.245.98","15.204.59.70","2.59.133.151","23.27.25.75","162.35.99.94")

    Detection Query 2 :

    sha256hash IN ("c1e81cfbaf7e4cccad7d7f43c1a624b791ba1b7f1d176e224455138604837b4c","5e99d6023dce9bb18d845a37fcdbc7ea574fdb20ab8d888ec54c695382d46036","6f84cc354b785157983efa8f4b674d2e1d6c3331017f29ff8d51bc43668d4b0f","535b9e298defd3449ba2b10b9828925d3ce344872dcbd9470c0e8db20f0aae83","2d692ee6dcb41c249c55881897b7dec0550b92963e07fccdb11ad655601977c3","66bcbc8c2b9d847a1e976e57972e10eac98e9b894cbf30510bff1e8d63efb81f","1c93ea48fa7ff886a6d81e44869dd7962309e95d01c1561df362b0b18007a562","9c15dc5a510bf2e8a16c846e61fa35c50ef733b72d4e47b6e8307498a398443c","4a1502affa36d106d5374bf02cf777956eef651176ec8964b26ff90f103dd506")

    Reference

    PHP2Shell Exploitation Targets PHP and PAN-OS Systems                                                                


    Tags

    VulnerabilityPHPCVE-2026ExploitGovernment Services and FacilitiesFinantial ServicesCommunicationsEducation

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.