What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers

Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web server without logging in. Palo Alto has not shipped fixed PAN-OS releases yet. Fortinet and Cisco published their own advisories, and neither company has confirmed a vulnerable product so far: Fortinet is checking 12 products, Cisco 31 products and cloud services.

Palo Alto says the risk is highest when a PAN-OS management interface accepts connections from the internet. Customers running the products Fortinet and Cisco are still investigating do not yet know whether they are exposed, and Cisco says no workarounds exist in the meantime.

Fortinet: 12 products under review, 12 cleared

Fortinet’s PSIRT advisory rates CVE-2026-109618 critical with a CVSS v3 score of 9.8 and lists it as not known to be exploited. FortiGuard Labs’ separate report rates both CVEs 9.2 under CVSS 4.0.

These 12 products are still under investigation: FortiADC, FortiADC Manager, FortiClient EMS, FortiDDoS, FortiDDoS-F, FortiSIEM, FortiMonitor, FortiClient Cloud, FortiSOAR, FortiSOAR PaaS, FortiGuard and FortiEndpoint.

Fortinet has confirmed that these 12 are not impacted: FortiOS, FortiManager, FortiAnalyzer, FortiWeb, FortiMail, FortiClient for Linux, Windows and macOS, FortiSASE, FortiAuthenticator, FortiSwitch and FortiNAC. FortiOS, the operating system that runs FortiGate firewalls, is on the cleared list.

The PSIRT advisory gives no fixed versions or workarounds for the products under review, and its virtual patch field reads “No.” FortiGuard Labs covers mitigation in a separate report aimed at PHP servers in general. There, FortiGuard says it has released virtual patches for both CVEs in version 37.316. FortiCNAPP detects both CVEs in PHP packages installed from Linux distribution repositories. Ubuntu, Debian and Alpine Linux 3.24 had published fixes when the report went out, while RHEL and its rebuilds, Amazon Linux and SUSE had not, so FortiCNAPP findings for those may not list a fixed version yet. FortiWeb customers are advised to review their web application protection policies and request inspection controls.

FortiGuard’s advice for PHP servers:

• Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply the vendor package that carries the fix.
• Where patching has to wait, isolate affected systems from untrusted networks or temporarily switch off exposed services.
• Set web server or reverse proxy limits on request size, input fields, multipart sections, headers and nesting depth. Fortinet says these reduce exposure and do not substitute for patching.
• Check for suspicious web requests, unexpected PHP worker behavior, unexplained process execution and unusual access to application files or databases, starting with internet-facing systems, before putting them back into production.

PHP 8.1 and older no longer get security updates from the PHP project, so Fortinet tells customers on those versions to look for backported fixes from their operating system vendor or move to a supported release.

Cisco: 31 products and services, no answers yet

Cisco’s advisory rates the vulnerabilities critical. Cisco lists no products as vulnerable. Its list of products confirmed not vulnerable is empty too.

Cisco is investigating 18 products and 13 cloud services:

• Network and content security: Cisco AI Defense (hybrid on-premises deployment), Cisco Hypershield, Cisco Identity Services Engine (ISE)
• Network management and provisioning: Cisco Business Process Automation (BPA), Cisco Catalyst Center (formerly DNA Center), Cisco Catalyst SD-WAN Manager, Cisco Nexus Dashboard Insights, Cisco WAN Automation Engine (WAE)
• Service provider routing and switching: Cisco ASR 5000 Series Software (StarOS), Cisco Policy Suite (CPS), Cisco Ultra Cloud Core (Converged Policy and Charging, Policy Control Function, and Subscriber Microservices Infrastructure)
• Voice and unified communications: Cisco Expressway Series
• Wireless: Cisco Ultra-Reliable Wireless Backhaul (URWB), Cisco Unified Industrial Wireless Software
• Application observability: AppDynamics On-Premises Secure Application, AppDynamics PHP Agent
• Cloud services: AppDynamics SaaS Secure Application, Cisco CX Cloud, Cisco Defense Orchestrator, Cisco IoT Control Center, Cisco Multicloud Defense, Cisco Panoptica, Cisco Secure Access, Cisco Secure Email Threat Defense, Cisco Umbrella, Cisco Vulnerability Management (formerly Kenna.VM), Cisco+ Secure Connect, Slido, Webex

Cisco says there are no workarounds for the vulnerabilities. Once the investigation turns up affected products, Cisco will add them to the advisory with bug IDs in its Bug Search Tool, and those bug entries will carry workarounds where available and fixed software releases. Cisco’s PSIRT says it is not aware of any malicious use of the vulnerabilities.

Palo Alto Networks: PAN-OS and Panorama affected, fix pending

Palo Alto’s advisory lists PAN-OS and Panorama as affected in all versions, with no special configuration needed to be exposed. Seven products are unaffected: Bridgecrew, Cloud NGFW, Cortex XDR Agent, Cortex XSOAR, Cortex Xpanse, Idira and Prisma Access.

Palo Alto rates the issue high, with a CVSS-B score of 8.7 and moderate urgency, below the 9.2 the advisory lists as the vendor score. The scoring vector Palo Alto uses for its own products counts a high impact on availability and no impact on confidentiality or integrity, which in plain terms scores the risk to PAN-OS as an outage, with no data exposure or tampering. The advisory does not explain how Palo Alto reached that assessment. Limiting management interface access to a single jump box lowers the score to 7.1. Palo Alto says it is not aware of malicious exploitation against its products.

Fixed PAN-OS releases are still on the way, and Palo Alto will add version numbers and release estimates to the advisory when it has them. Until then, Palo Alto recommends:

• Restricting management interface access to trusted internal IP addresses, following its best practice deployment guidelines.
• Relying on threat prevention coverage. Customers with Frontier Virtual Patching received Threat ID 543004 at 10:21 p.m. PT on October 20, hours before PHP published its fixes. Advanced Threat Prevention added standard IPS coverage through signatures 543004, 97622, 97623, 97624 and 97625 on October 21.

Most public exploit code doesn’t work yet

VulnCheck reproduced what it believes are both PHP2Shell bugs late on October 20, after details of the flaws leaked ahead of the planned release. The team’s early analysis is that the bugs can be exploited for remote code execution on ARM64 systems and on x86 systems without ASLR. Address space layout randomization (ASLR) shuffles where a program’s code and data sit in memory, so an exploit cannot rely on fixed addresses.

Dozens of proof-of-concept repositories have appeared on GitHub. VulnCheck, which is reviewing them as they come in, says only a very small number implement what it believes is the correct exploit mechanism, and none of those bypass ASLR on x86-64 systems on their own. On ARM64, VulnCheck says, ASLR can be brute-forced relatively easily.

VulnCheck still expects widespread exploit attempts built on public proofs of concept, whether or not the code works or the target can be exploited, so a flood of attempts in the logs will say little about whether a given server is at risk.

Palo Alto has said it will update its advisory with fixed PAN-OS versions as they become available, and Cisco will update its product lists as its investigation progresses. Fortinet’s FortiGuard Labs says it is monitoring the situation and will release additional protections as they become available.