Software security | Vulnerabilities

PHP2Shell Flaws Reach Palo Alto Firewall Management Interfaces

Palo Alto says every supported PAN-OS branch and all Panorama systems are exposed via the management interface, with hotfixes due by month end.

By Content Team

Oct 26, 2026

ON THIS PAGE

Palo Alto Networks has confirmed that the two critical PHP2Shell flaws in PHP, CVE-2026-109618 and CVE-2026-109619, affect every release of PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 on PA-Series and VM-Series firewalls, plus all Panorama systems. No special configuration is needed to be vulnerable. Two cloud services, Cortex XCORE and WildFire Cloud, were also affected but have since been fixed.

PHP scores both flaws 9.2 on CVSS v4.0, but Palo Alto rates the impact on its products at 8.7, High, and lists availability as the affected property rather than data theft or takeover. Exposure is limited to the management web interface and XML API, plus any dataplane interface with a management profile attached. GlobalProtect portals and gateways aren’t affected.

Palo Alto says it isn’t aware of malicious exploitation of its products, though Unit 42 has seen proof-of-concept exploits for PHP2Shell. The first PAN-OS hotfixes are estimated for October 26, with the rest due by October 30. Until then, admins should restrict management interface access to trusted internal IPs and avoid internet-facing exposure.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?