Palo Alto says PHP RCE flaws affect PAN-OS; hotfixes still pending
Original title: Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products
CVE-2026-109618 and CVE-2026-109619 hit several PAN-OS branches via management interfaces; Palo Alto reports no attacks on its products.
Palo Alto Networks confirmed two critical PHP remote code execution flaws, tracked as PHP2Shell, affect PAN-OS and previously affected two cloud services. Exposure is limited to the management web interface and XML API, or a dataplane interface with a management profile. The company updated its advisory on October 24 and said it knew of no malicious exploitation of its products, while Unit 42 has seen proof-of-concept exploits for the wider PHP bugs. PAN-OS hotfixes remain scheduled, not yet available.
Unconfirmed: Palo Alto says it is not aware of malicious exploitation of its products, and hotfix dates are estimates.
- Affected branches are PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 on PA-Series and VM-Series.
- Panorama, including virtual and M-Series systems, is affected with no special configuration required.
- Earliest estimated fixes are 10.2.18-h13, 11.1.16-h4, and 11.2.10-h16 on October 26.
- Cortex XCORE SaaS and WildFire Cloud were fixed on October 21 and October 22.
- Palo Alto rates product impact 8.7; the underlying PHP flaws score CVSS 4.0 9.2.
Impact: Remote code execution through the management interface
| Product | Affected | Fixed in |
|---|---|---|
| Palo Alto Networks PAN-OS | 10.2, 11.1, 11.2, 12.1, and 12.2 | 10.2.18-h13, 11.1.16-h4, 11.2.10-h16, 12.2.4-h1 and later estimated hotfixes |
| Palo Alto Networks Panorama | virtual and M-Series deployments | — |
| Palo Alto Networks Cortex XCORE SaaS | previously affected | fixed October 21 |
| Palo Alto Networks WildFire Cloud | previously affected | fixed October 22 |
- 1.Restrict management access to trusted internal addresses or a dedicated jump box until hotfixes ship.
- 2.Install the matching PAN-OS hotfix once the estimated release is available.
- 3.Use Threat Prevention signature 543004 and content versions 9162, 9163, and 9164 onward where applicable.
- Vendors
- Palo Alto Networks
- Organizations
- Unit 42
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 |
From the original article
2 min read at cybersecuritynews.com
Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have prompted planned firewall hotfixes and guidance to restrict access to management interfaces. The company updated its security advisory on October 24, 2026.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.