Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and have already impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws prompted planned firewall patches and guidance to restrict access to management interfaces.
The company updated its security advisory on October 24, 2026. It stated that it was not aware of any malicious exploitation of its products. However, Unit 42 has seen proof-of-concept exploits for the broader PHP vulnerabilities, known as PHP2Shell.
PHP RCE vulnerabilities
Both flaws involve PHP’s handling of serious errors via longjmp(), a function that transfers program execution to a previously saved point. Unsecured memory left during this process can allow attackers to execute code remotely.
CVE-2026-109618 occurs when an out of memory error interrupts query processing and leaves query memory uninitialized. Subsequent cleanup operations may use this incomplete memory. Attackers can trigger a memory exhaustion to reach this dangerous state and achieve remote code execution.
CVE-2026-109619 involves global memory references that continue to point to memory after it is freed. Subsequent requests can read or act on these stale references, creating another path to execute attacker-controlled code.
The underlying PHP vulnerabilities have a CVSS 4.0 score of 9.2. Palo Alto rates the impact on its products at 8.7, which is high severity. Its product-specific assessment identifies availability as the affected security property, rather than confirming data theft or unauthorized modifications.
Affected PAN-OS versions and services
Affected branches include PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 on PA-Series and VM-Series firewalls. Panorama deployments, including virtual systems and M-Series, are also affected. No special configuration is necessary for the software to be vulnerable.
Exposure is limited to the management web interface, covering the HTTPS admin console and XML API. A data plane interface is assigned only when it is associated with a management profile. GlobalProtect portals, gateways, Clientless VPN and Captive Portal are not affected.
Cortex XCORE SaaS and WildFire Cloud were previously affected, but received patches on October 21 and 22, respectively. Cloud NGFW, Cortex XDR, Cortex XSIAM, Prisma Cloud, Prisma Access, and the GlobalProtect app are among the products currently listed as not affected.
PAN-OS patches remain scheduled rather than available as of October 24. The estimated earliest releases are 10.2.18-h13, 11.1.16-h4, and 11.2.10-h16 on October 26. PAN-OS 12.2.4-h1 is expected on October 28, with the other listed fixes expected until October 30. These dates remain estimates.
Until patches arrive, administrators should limit management access to trusted internal IP addresses or a dedicated jump box. Internet-accessible management interfaces present the highest risk. Previous reports on RedTail exploiting Palo Alto firewalls and ransomware targeting VPN devices cover separate threats, but unconfirmed PHP2Shell attacks against PAN-OS.
Threat prevention coverage includes signature 543004 and additional signatures provided from content versions 9162, 9163, and 9164. Protection requires routing management traffic through a data plane port, configuring the inbound certificate, decrypting HTTPS traffic, and enabling threat prevention inspection.
Administrators should follow vendor updates and the Unit 42 threat briefing, verify their exact patch path, and treat access restrictions as temporary protections, not replacements for installing the fixed version of PAN-OS once available.
Update defenses against new malware as it emerges. Integrate TI Feeds with data from 16,000 SOCs.
Gn bussni
