Palo Alto Issues Urgent Advisory on PHP2Shell RCE Flaws Impacting PAN-OS

Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities—tracked as CVE-2026-109618 and CVE-2026-109619—affect PAN-OS and several management interfaces on PA-Series and VM-Series firewalls, as well as Panorama deployments. While the vendor said it is not aware of active malicious exploitation against its products, Unit 42 has observed proof-of-concept exploits for the broader PHP issue known as PHP2Shell, prompting planned hotfixes and guidance to restrict management access until fixes are available.

What the vulnerabilities are

CVE-2026-109618 and CVE-2026-109619 stem from PHP’s error handling and unsafe memory use during longjmp() operations. CVE-2026-109618 occurs when an out-of-memory error interrupts request handling and leaves request memory uninitialized; subsequent cleanup may use that incomplete memory, enabling an attacker to trigger memory exhaustion to reach a remote code execution state. CVE-2026-109619 involves global memory references that still point to freed memory, allowing later requests to act on stale references and creating a second RCE vector. The underlying PHP flaws carry a CVSS 4.0 score of 9.2; Palo Alto rates the impact on its products at 8.7 (high), identifying availability as the affected security property rather than data theft or unauthorized changes.

Products, versions, and exposure

Affected PAN-OS branches include 10.2, 11.1, 11.2, 12.1, and 12.2 running on PA-Series and VM-Series firewalls. Panorama deployments—including virtual and M-Series—are also listed as impacted. No special configuration is required for the software to be vulnerable; exposure is limited to management interfaces: the HTTPS administration console and the XML API. A dataplane interface is affected only when a management profile is attached. GlobalProtect portals, gateways, Clientless VPN, and Captive Portal are not impacted. Several cloud services that had been affected—Cortex XCORE SaaS and WildFire Cloud—received fixes on October 21 and October 22, respectively. Other listed cloud and endpoint products (Cloud NGFW, Cortex XDR, Cortex XSIAM, Prisma Cloud, Prisma Access, and the GlobalProtect App) are currently listed as unaffected.

Patch schedule and temporary timelines

As of the vendor advisory update, PAN-OS fixes were scheduled but not yet released. Earliest estimated hotfix releases reported include:

• PAN-OS 10.2.18-h13, 11.1.16-h4, and 11.2.10-h16 — estimated October 26
• PAN-OS 12.2.4-h1 — estimated October 28
• Additional hotfixes planned through October 30

These dates were presented as estimates in the advisory. Cortex XCORE SaaS and WildFire Cloud already received fixes on October 21 and October 22.

Immediate mitigations administrators should apply

Until vendor hotfixes are installed, administrators should treat management-facing services as high risk and apply temporary access restrictions:

• Limit management interface access to trusted internal IP addresses or a dedicated jump box.
• Avoid internet-facing management interfaces; route management traffic through secured dataplane ports when possible.
• Use a jump host for administration and restrict direct administrative access.
• Configure inbound certificates properly and decrypt HTTPS management traffic so threat inspection can operate.
• Enable threat prevention inspection for management traffic routed through the dataplane.

Detection, threat prevention, and signatures

Unit 42 notes proof-of-concept exploits for the broader PHP2Shell issue, underscoring the need for rapid defense. Palo Alto’s Threat Prevention coverage includes signature 543004 and additional signatures delivered in content versions 9162, 9163, and 9164 onward. Proper protection requires routing management traffic through a dataplane port, configuring inbound certificates, decrypting HTTPS, and enabling threat prevention inspection. Administrators should monitor vendor release updates, verify the exact hotfix path for their deployment, and treat access restrictions as temporary safeguards—not replacements for installing the fixed PAN-OS releases once they become available.

Operational recommendations and next steps

– Confirm whether your PAN-OS or Panorama deployment falls within the affected branches and identify exposed management interfaces.

• Apply temporary access controls immediately (trusted IPs, jump boxes) and remove any internet-facing management endpoints.
• Prioritize installing the vendor hotfixes when released according to your product’s recommended hotfix path.
• Update threat prevention signatures and content versions to the indicated releases and monitor Unit 42 advisories for exploitation indicators and PoC details.
• Integrate threat intelligence feeds and update defenses against new malware and exploitation techniques as they appear.

Final note

Palo Alto’s advisory frames the impact primarily as an availability risk and, while no in-the-wild exploitation against PAN-OS was confirmed at the time of the update, the existence of PHP2Shell proof-of-concepts and high-severity scores make rapid mitigation and timely patching essential for affected administrators.