* [Blog](https://www.paloaltonetworks.com.au/blog) * [SASE](https://www.paloaltonetworks.com.au/blog/sase/) * [AI and Cybersecurity](https://www.paloaltonetworks.com.au/blog/security-operations/category/ai-and-cybersecurity/) * PHP2Shell is Being Exploi... # PHP2Shell is Being Exploited: How Prisma Browser Protects Users from Compromised Websites [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com.au%2Fblog%2Fsase%2Fphp2shell-is-being-exploited-how-prisma-browser-protects-users-from-compromised-websites%2F) [](https://twitter.com/share?text=PHP2Shell+is+Being+Exploited%3A+How+Prisma+Browser+Protects+Users+from+Compromised+Websites&url=https%3A%2F%2Fwww.paloaltonetworks.com.au%2Fblog%2Fsase%2Fphp2shell-is-being-exploited-how-prisma-browser-protects-users-from-compromised-websites%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com.au%2Fblog%2Fsase%2Fphp2shell-is-being-exploited-how-prisma-browser-protects-users-from-compromised-websites%2F&title=PHP2Shell+is+Being+Exploited%3A+How+Prisma+Browser+Protects+Users+from+Compromised+Websites&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com.au/blog/sase/php2shell-is-being-exploited-how-prisma-browser-protects-users-from-compromised-websites/&ts=markdown) \[\](mailto:?subject=PHP2Shell is Being Exploited: How Prisma Browser Protects Users from Compromised Websites) Link copied By [Tom Goldberg](https://www.paloaltonetworks.com/blog/author/tom-goldberg/?ts=markdown "Posts by Tom Goldberg") and [Monique Lance](https://www.paloaltonetworks.com/blog/author/monique-lance/?ts=markdown "Posts by Monique Lance") Oct 30, 2026 4 minutes [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown) [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown) [Cloud Delivered Security Services](https://www.paloaltonetworks.com/blog/network-security/category/cloud-delivered-security-services/?ts=markdown) [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown) [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown) [Product Features](https://www.paloaltonetworks.com/blog/sase/category/product-features/?ts=markdown) [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [Secure Browser](https://www.paloaltonetworks.com/blog/sase/category/secure-browser/?ts=markdown) [Strata Network Security Platform](https://www.paloaltonetworks.com/blog/network-security/category/strata-network-security-platform/?ts=markdown) [Prisma Browser](https://www.paloaltonetworks.com/blog/tag/prisma-browser/?ts=markdown) [Secure Browser](https://www.paloaltonetworks.com/blog/tag/secure-browser/?ts=markdown) When attackers compromise legitimate websites, the danger doesn't stop at the web server. Those same websites can become vehicles for phishing, malware, and other attacks targeting unsuspecting visitors. That's the risk highlighted by two recently disclosed critical vulnerabilities in PHP, the server-side programming language powering much of the web. Known as **PHP2Shell** , these vulnerabilities could allow unauthenticated attackers to execute malicious code on vulnerable web servers, potentially giving them control over legitimate websites. And the threat is already real. Recent industry reports^1^ say attackers began attempting to exploit PHP2Shell on October 17, four days before the vulnerabilities were publicly disclosed. Researchers have since confirmed successful remote code execution against vulnerable PHP installations in honeypot environments, and CISA has added both vulnerabilities to its[Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog). # From Compromised Servers to Browser-Based Attacks These attacks can take several forms: * **Credential theft:** Injected phishing forms or redirects to fraudulent authentication pages. * **ClickFix attacks:** Malicious instructions that trick users into executing commands to install malware. * **Financial data theft:** JavaScript skimmers designed to capture payment card information. * **Malicious downloads:** Compromised websites delivering scripts or malware. * **Malicious script injection:** Hidden scripts and techniques such as EtherHiding that retrieve malicious payloads. These attacks are particularly dangerous because users may be visiting familiar, previously trusted websites. The domain may have an established reputation, even though the content being delivered has been weaponized. **Prisma Browser Detects the Threat, Not the Technology** For Prisma Browser customers, protection against malicious content delivered through compromised websites isn't new. Advanced Web Protection has been available in Prisma Browser since October 2025, a full year before PHP2Shell was disclosed. It continuously scans webpages and their components in real time to detect and block malicious content, including obfuscated code, injected scripts, and other web-based threats. For enterprises, the question isn't only whether their own web infrastructure is vulnerable. It's also what happens when employees visit a legitimate website that attackers have compromised. That's where browser security becomes critical. Unlike approaches that rely on identifying the technology powering a website, Prisma Browser's protection is content-based, not technology-based. It works regardless of what the web server runs. This distinction is critical. Some security solutions attempt to apply security policies based on whether PHP is being used to power the website, but this is too broad since the vast majority of the web is powered by PHP. This is like flagging every email written in English because most phishing emails are in English. This approach does not work in actually identifying if a specific page is serving malicious content and can slow down business. In fact, we've seen this protection in action in live customer environments this month, with detections ranging from credit card skimmers and ClickFix attacks to malicious script injections. # Already Detecting and Blocking Compromised Sites: Real Examples from This Month Over the past couple weeks alone, Advanced Web Protection has caught compromised PHP sites that contained credit card skimmers, script droppers, ClickFix attacks, malicious script injections, and EtherHiding injections. For detailed examples, you can check these recent posts on X: * [Injected Credit Card Skimmer](https://x.com/Unit42_Intel/status/2050367689542000737) * [ClickFix Attack](https://x.com/Unit42_Intel/status/2062945300382151027?s=20) These real-world detections illustrate the range of attacks that compromised websites can deliver, from financial data theft to malware installation and social engineering. Compromised PHP and WordPress websites are a recurring source of malicious activity detected by Advanced Web Protection. While these examples have not been attributed specifically to PHP2Shell exploitation, they demonstrate that Prisma Browser is already protecting customers against the downstream threats that compromised websites can introduce. We're not waiting for the next vulnerability to become an active attack. We're already detecting and blocking malicious content delivered through compromised websites. # The Bigger Lesson: Protection Is On the Server Side And On The User End PHP2Shell reinforces an important security principle. The attack landscape changes constantly driving the need for a strong multi-layered security strategy. Enterprises must invest time and resources now to identify exposure, remediate vulnerabilities, investigate compromises, and protect users from the threats they encounter online. Website administrators must address server-side vulnerabilities through appropriate patching and remediation. But organizations also need to protect employees from malicious content delivered through websites they don't own or control. Prisma Browser and Advanced Web Protection provide defense inside the browser, where a compromised website meets your users, because a trusted website doesn't always serve trusted content. To learn more about how Prisma Browser detects and blocks PHP exploits and other web threats, [see Advanced Web Protection in action](https://www.paloaltonetworks.com/sase/prisma-browser/contact-us). ^1^[Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot, October, 2026](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/) *** ** * ** *** ## Related Blogs ### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown), [Next-Generation Firewalls](https://www.paloaltonetworks.com/blog/network-security/category/next-generation-firewalls/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Secure Browser](https://www.paloaltonetworks.com/blog/sase/category/secure-browser/?ts=markdown) [#### Expand Security From Network to User: What's New With Prisma Browser and Next-Gen Firewall In PAN-OS 12.2](https://www.paloaltonetworks.com.au/blog/sase/expand-security-from-network-to-user-whats-new-with-prisma-browser-and-next-gen-firewall-in-pan-os-12-2/) ### [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Secure Browser](https://www.paloaltonetworks.com/blog/sase/category/secure-browser/?ts=markdown), [Strata Network Security Platform](https://www.paloaltonetworks.com/blog/network-security/category/strata-network-security-platform/?ts=markdown), [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [#### Why Your Microsoft Intune Deployment Needs a Secure Mobile Browser](https://www.paloaltonetworks.com.au/blog/sase/why-your-microsoft-intune-deployment-needs-a-secure-mobile-browser/) ### [Product Features](https://www.paloaltonetworks.com/blog/sase/category/product-features/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [#### Unlock Frictionless Private App Access with Prisma Browser Connector](https://www.paloaltonetworks.com.au/blog/sase/unlock-frictionless-private-app-access-with-prisma-browser-connector/) ### [Product Features](https://www.paloaltonetworks.com/blog/sase/category/product-features/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [#### Seamless and Secure RDP and SSH Access Using Prisma Browser](https://www.paloaltonetworks.com.au/blog/sase/seamless-and-secure-rdp-and-ssh-access-using-prisma-browser/) ### [Product Features](https://www.paloaltonetworks.com/blog/sase/category/product-features/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [#### Complete Web Protection Starts in the Browser](https://www.paloaltonetworks.com.au/blog/sase/complete-web-protection-starts-in-the-browser/) ### [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/sase/category/product-features/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [#### Why Securing Web Sessions is the Missing Link in Zero Trust](https://www.paloaltonetworks.com.au/blog/sase/why-securing-web-sessions-is-the-missing-link-in-zero-trust/) ### Subscribe to Sase Blogs! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com.au/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * Observability * [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language