# Researchers Report PAN-OS Firewall Exploits

Researchers report that attackers chained a custom PHP2Shell exploit with a kernel privilege-escalation exploit to gain root access on some internet-exposed Palo Alto Networks PAN-OS firewalls. One report says 25 servers across four countries were compromised, including equipment in a U.S. government-affiliated environment; another cites approximately 19,000 exposed targets worldwide identified through FOFA. The reports do not identify affected software versions, named agencies, contracts, or procurement opportunities, but they raise operational and supply-chain security concerns for agencies and contractors that rely on these firewalls.

- Agencies and contractors should verify whether their PAN-OS firewalls are affected and apply the vendor’s fixes, then assess for persistent access and possible credential compromise, as recommended in the reporting.
- Reduce exposure of firewall management interfaces and consider independent perimeter controls; port knocking and high-numbered ports are discussed as possibilities, not verified mitigations.
- Procurement teams can use the incident to inform firewall security reviews and discussions with service providers, while recognizing that the signals identify no specific solicitation, award, or contract action.

**Jurisdictions:** federal, international
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 30, 2026

### Vendors
- Palo Alto Networks ()

### Key Quotes
> If you must expose yours to the internet, consider a raw IP whitelist on the untrusted side that does not rely on PAN-OS itself. An Azure NSG is a simple example.
> — Original poster

### Sources
- [Exploit Chain Roots Firewalls and Breaches Federal Network -- Security Today](https://securitytoday.com/articles/2026/10/30/exploit-chain-roots-firewalls-and-breaches-federal-network.aspx) - Security Today
- [Custom PHP2Shell Exploit Chained with Kernel LPE to Root Versions of Palo Alto Networks PAN-OS Firewalls in the Wild](https://www.reddit.com/r/cybersecurity/comments/1xj0jec/custom_php2shell_exploit_chained_with_kernel_lpe) - reddit-cybersecurity