Palo Alto Networks confirmed on Wednesday that every supported version of PAN-OS and Panorama is affected by PHP2Shell, the pair of critical PHP vulnerabilities disclosed this week, and said fixed firewall releases are not yet available.
The advisory , published under CVE-2026-109618, lists all releases of PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, plus all Panorama versions, as vulnerable, with the fix date for each branch marked “TBD.” No special configuration is required for a device to be exposed. Palo Alto said it is not aware of malicious exploitation against its products.
PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two memory-handling bugs in the PHP engine that the PHP project fixed on October 21 in PHP 8.5.12 , 8.4.27, 8.3.36 and 8.2.35. PHP rates both 9.2 on CVSS v4.0. Researchers at Calif, Wiz and OpenAI found them in August, and details leaked online a day before the planned disclosure.
PAN-OS bundles PHP to run its management web interface, and Palo Alto says the flaws are reachable only through that interface, meaning the HTTPS web UI and the XML API. An ordinary dataplane interface becomes exposed when an interface management profile is attached to it.
The GlobalProtect portal, gateway, and Captive Portal are not affected. Cloud NGFW, Prisma Access, the GlobalProtect app, Prisma Access Agent, Prisma Cloud, and the Cortex XDR agent, XSIAM, XSOAR, and Xpanse are listed as unaffected.
How does PHP2Shell work?
CVE-2026-109618 is triggered when PHP runs out of memory while still building internal structures for an incoming request. PHP marks part of that state as ready before every allocation has finished; if an allocation fails and nothing rolls back the half-built state, the cleanup code later treats uninitialized memory as valid. Red Hat says an unauthenticated attacker can exploit this to execute code against mod_php in its default configuration.
The SANS Internet Storm Center described how an attacker exhausts memory in the first place. A multipart request sent without a Content-Length header can slip past the post_max_size limit, the number of headers is not capped, and the max_file_uploads limit ignores empty files, whose bookkeeping structures still consume memory.
CVE-2026-109619 leaves worker-global pointers pointing to memory that a request has already freed, so the request served by the same PHP worker reads or branches on that stale data. Sansec traced the vulnerable code back to PHP 5.4.0, released in 2012.
Why does Palo Alto score it lower than PHP?
Palo Alto rates the issue in its own products 8.7 under CVSS-B, but the vector behind that score records a high impact on availability and no impact on confidentiality or integrity. Read literally, Palo Alto is scoring the PAN-OS risk as a firewall outage rather than a takeover. The score falls to 7.1 when only a jump box can reach the management interface.
The same advisory lists PHP’s own 9.2 score, which assumes full loss of confidentiality, integrity and availability, and does not explain why the firewall impact was assessed differently. Fortinet’s PHP2Shell advisory rates CVE-2026-109618 even higher, at 9.8 under CVSS v3.
Attackers have been probing PHP servers since before the patches landed. Amazon logged attempts on its honeypots on October 17, four days before disclosure , and Cloudflare CEO Matthew Prince said the company saw thousands of attempts in the 10 hours before the announcement. watchTowr said most exploit scripts being sprayed either fail, only test response timing, or crash the target.
“Whilst nobody has been successful to date, we don’t expect that will last long,” watchTowr head of threat intelligence Jake Knott said. CISA had not observed exploitation, and neither CVE was in its Known Exploited Vulnerabilities catalog as of October 22.
The PAN-OS management interface has been a target before. In February 2025, attackers exploited CVE-2025-0108 , an authentication bypass in that interface that let them invoke PHP scripts, a day after Palo Alto released the fix.
What should PAN-OS admins do before the patch?
Palo Alto’s primary advice is to restrict the management interface to trusted internal IP addresses, as outlined in its best-practice guide , and to check every dataplane interface for an attached management profile.
Customers on Advanced Threat Prevention Plus with Frontier Virtual Patching , running PAN-OS 12.2.4 or later, received signature 543004 at 10:21 p.m. PT on October 20, before PHP published its fixes.
Palo Alto is not the only appliance vendor still working on PHP2Shell. Fortinet has cleared 12 products, including FortiOS, and is reviewing 12 more, while Cisco is investigating 31 products and cloud services. The Dutch NCSC keeps a running list of vendor statuses.
Across the wider internet, Palo Alto’s Unit 42 said Cortex Xpanse had identified more than 22.6 million exposed instances potentially vulnerable to the two flaws.
Join the conversation. Ask questions, solutions, and help others.
Be the first to start the discussion!
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
