PHP2Shell: Virtual Patching Is the Strategy
In this blog
Amazon recorded an exploitation attempting its MadPot honeypots on October 17th, four days before public disclosure. The attempt preceded the patch release. Organizations relying on disclosure to start their response were already behind the observed attack activity.
Organizations need protection while patches are unavailable and while remediation is underway. PHP2Shell shows why those periods belong in the response plan.
The gap that can't wait
Patch Tuesday remains part of routine maintenance, but exploitation can begin within hours of disclosure. The draft cites the 2026 Exploit Intelligence Report for a 29% exploitation rate within 24 hours and an average of 54 days to patch a high or critical vulnerability. PHP2Shell exploit code was circulating before the CVEs were published
In Qualys' sample, 71% of PHP installations with a known version ran end-of-life branches. Those branches have no official upstream patch release to apply.
The question organizations need to answer isn't just "how fast can we patch?" It's: "What protects us while we do, and what protects us when we can't?"
That's the conversation Palo Alto Networks built Frontier Virtual Patching to answer. PHP2Shell is a real-world proof point that the strategy works.
What PHP2Shell affects
PHP2Shell describes two memory vulnerabilities in the PHP engine itself (CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2) that allow unauthenticated remote code execution against any HTTP endpoint running an affected version. No vulnerable application required; any PHP page is a target. Wiz Research confirmed working pre-auth exploits against the default container images for WordPress, Drupal and Joomla.
For a full technical breakdown of the vulnerability mechanics, affected version landscape and exploitation chronology, see the companion reference: PHP2Shell: Exploitation Before Disclosure a Technical Reference
22.6 million instances at risk
Cortex Xpanse identified 22.6 million internet-exposed PHP instances potentially vulnerable to these CVEs. The recent NetScaler issue involved about 50,000 potentially exposed instances. These are exposure estimates, not counts of confirmed compromises.
Inside the perimeter, Installation data and attack telemetry show the scale of the issue:
- Qualys found roughly 167 million PHP installations across its customer base
- 71% of installations with a known version run end-of-life branches (PHP 5.4 through 8.1)
- End-of-life branches will receive no official fix
- Only 199,000 installations were patched in the first 12 hours after disclosure
- Within one day, Cloudflare observed exploitation attempts grow from tens of thousands to millions per day
Patching supported versions may take a weekend. Migrating a legacy application off PHP 7.x can take months. Network protection needs to remain in place while the application team completes the work..
Frontier Virtual Patching before disclosure
Palo Alto Networks Frontier Virtual Patching, available through ATP Plus (Advanced Threat Prevention Plus) on PAN-OS 12.2.4 delivered Threat ID 543004 at 10:21 p.m. PT on October 20.
On October 21, Advanced Threat Prevention added signatures 97622 through 97625 in content version 9162 as coverage expanded to address exploit variants.
Where the vulnerability intelligence comes from
Palo Alto Networks pre disclosure vulnerability intelligence comes from how they source vulnerability data.
- NOVA, its AI harness, scans more than 4,000 major open-source repositories, including web and CMS platforms in PHP2Shell's exposure surface. The described workflow generates proof-of-concept exploits, builds protections and red-team tests them against AI-generated evasion variants before public reporting.
- The Critical Defense Program brings in embargoed findings from partners, including IBM Lightwell and Microsoft MAPP. Vulnerability clearinghouses provide another source of pre-disclosure intelligence. These feeds allow protections to ship alongside or ahead of an official patch.
Lee Klarich, Palo Alto Networks Chief Product Officer, described the patching problem in his response to PHP2Shell:
"It simply takes too long to apply patches to every system."
Software upgrades remain the remediation goal. Virtual patching provides network protection while that work runs, including periods when a software patch is unavailable.
ATP Plus powers Frontier Virtual Patching on PAN-OS 12.2.4 or later. The draft describes an Advanced Virtual Patching toggle in the Vulnerability Protection Profile and more than 16,000 signatures covering open-source software, commercial products and OT/IoT systems.
Keeping exploit details in the cloud
Traditional IPS content distributes signature patterns to firewalls. Recipients may be able to study those patterns to infer the vulnerability being protected. Frontier Virtual Patching keeps its detailed inspection logic in the cloud.
A non-reversible probabilistic pre-filter on the firewall performs coarse matching. Matching traffic goes to the ATP Plus cloud engine for a precise verdict. Sensitive exploit details remain in Palo Alto Networks' cloud.
You WWT account team can discuss an ATP Plus evaluation.
See it in action: The threat intelligence screen
The screenshots below show the threat context and network evidence available in Advanced Threat Prevention Plus. The results shown describe the pictured example scenario.
The Threat Intelligence screen provides:
- CVE mappings, the EPSS score and an "Exploited in the wild" indicator.
- A timeline relating signature deployment to public disclosure.
- Attack-attempt counts and the recorded enforcement action.
The example uses Threat ID 32649. Its timeline displays "31 Days Ago · Pre-disclosure Protection Published!"
The Log Viewer shows 200 blocked events for Threat ID 32649, including pre-disclosure entries. Strata Copilot is available in the same view to summarize threat context, run an Agent Assist investigation or troubleshoot gaps.
One checkbox. Immediate coverage.
With ATP Plus and a supported PAN-OS version in place, enable the feature in the Vulnerability Protection Profile. Check the enforcement actions as part of the same review.
The screenshots use IT-Vulnerability-Protection-1 and show 25,008 active signatures across the platform. Find the control labeled Advanced Virtual Patching in that profile.
Before enablement:
☐ Advanced Virtual Patching (unchecked)
After enablement:
☑ Advanced Virtual Patching (enabled)
The coverage is currently, as of this writing, 16,680 signatures across open-source libraries, commercial software and OT/IoT devices. The draft includes PHP2Shell Threat ID 543004 in that coverage.
This network-based approach requires no application agent or application-level code change. The draft also states that enablement requires no maintenance window.
The firewall inspects traffic passing through it. Pre-disclosure signatures can be in place before a vulnerability is public, provided the affected traffic is covered by the deployed policy.
Protect now, patch later
Your current firewall and software version determine the deployment work.
Gen 5 NGFW on PAN-OS 12.2.4 or later
For a supported existing deployment, enable ATP Plus and open the Vulnerability Protection Profile. Turn on virtual patching and verify enforcement. The path described here requires no new hardware or deployment, and the draft states that no maintenance window is needed.
Free 30-day VM-Series trial
For organizations without a Gen 5 device or PAN-OS 12.2.4, the offer described here is a free 30-day VM-Series trial to mitigate PHP2Shell during remediation.
The proposed VM-Series deployment uses virtual wire mode.
In virtual wire (vwire) mode, VM-Series sits in front of vulnerable PHP segments on a single VLAN. The described design preserves IP addressing, routing and firewall rules, and can be removed using the same approach.
The stated trial license includes ATP Plus, Frontier Virtual Patching, pre-disclosure signatures and the full ATP signature set from day one. A 30-day trial provides an initial protection period. Organizations remediating end-of-life branches or vendor appliances may need longer.
PHP2Shell has prompted broad exploitation attempts. Internet-facing PHP on end-of-life versions needs interim protection while migration and remediation proceed.
Where Palo Alto Networks fits
Frontier Virtual Patching provides network-level protection. Other platform components address exposure discovery and host activity:
- Cortex Xpanse identifies internet-facing PHP exposure. Confirm that the PHP attack surface rule is active and review its findings.
- Advanced Threat Prevention Plus provides inline exploit protection, including pre-disclosure coverage. Confirm the current content and enforcement status for PHP2Shell Threat ID 543004.
- Cortex Cloud identifies vulnerable PHP versions in running containers, registries and cloud workloads. The draft also describes infrastructure-as-code (IaC) scanning as a way to catch the issue before deployment.
- Cortex XDR / XSIAM monitors post-exploitation behavior at the host layer, including process chains, shell spawning and credential access.
Use these findings to track exposed assets and verify which controls cover them. Remediation records should show which systems still need an upgrade.
Plan protection around the remediation work
PHP2Shell was found with AI assistance in August. Exploitation attempts preceded the patch release, and reports reached millions of attempts within 24 hours. The response plan has to account for attacks that arrive before disclosure.
Maintain a PHP inventory before an advisory forces an urgent search. Establish virtual patching coverage while software fixes are unavailable, and keep upgrades moving once fixes arrive. Network protection remains an interim control during remediation.
Frontier Virtual Patching makes pre-disclosure network protection available through ATP Plus. Customers still need to verify that their affected traffic is inspected and that the configured action blocks the exploit.
Contact your WWT account team to validate ATP Plus coverage or arrange a PHP exposure assessment. If you need the free VM-Series trial, ask the team to confirm the offer and licensing before planning the deployment. Engagements are underway now.