Two critical remote code execution flaws in PHP, nicknamed PHP2Shell, were patched on October 21. Since then it has become clear that the bug also reaches network appliances: Palo Alto Networks says its PAN-OS firewalls and Panorama management servers are affected and has told customers to lock down management access while fixes are prepared.
What happened
The PHP project released emergency updates for CVE-2026-109618 and CVE-2026-109619, each rated 9.2 (critical) on CVSS v4.0. One is a memory-corruption bug triggered when a request runs out of memory; the other involves stale internal state that a later request on the same worker can reuse. Reporting says an attacker can run code on a web server without logging in. Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 7.4, 8.0 and 8.1 are unsupported and received only source backports.
The newer development is the appliance fallout. Palo Alto’s advisory, as updated on October 22, lists PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2, Panorama, and WildFire WF-500 appliances as affected. The flaws are reachable through the management interface (web UI and XML API). Palo Alto rates the issue 8.7 if that interface faces the internet and 7.1 if access is limited. It lists hotfix targets such as PAN-OS 12.2.4-h1 and 11.2.16-h1, but the coverage we reviewed did not give release dates. Cloud NGFW, Prisma Access and the GlobalProtect app are listed as not affected.
Is it being exploited?
Attempts, yes; confirmed compromises, not publicly. Amazon Threat Intelligence recorded an exploitation attempt on October 17, four days before disclosure, after details leaked during the embargo. After the release, watchTowr and Cloudflare reported attack traffic. Palo Alto says it is not aware of malicious exploitation against its products, and as of October 23 neither CVE was in CISA’s Known Exploited Vulnerabilities catalog.
Who is affected
Any server running PHP to serve web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php described as the highest risk. That covers most WordPress hosting. Palo Alto firewall administrators whose management interface is reachable from the internet are the other exposed group. As of October 22, Fortinet and Cisco had not confirmed vulnerable products, though lists of affected vendors were still changing.
What to do
- Update PHP to a fixed version. Distribution packages may carry the fix under an older version number, so check the changelog for the CVE IDs. Managed hosts should confirm they have patched.
- If you cannot patch yet, the vendor-suggested reductions are to disable session upload progress (session.upload_progress.enabled=0), keep post_max_size low and set request-size limits at the web server. These do not make a server safe.
- Palo Alto customers: restrict management access to trusted internal addresses or a jump host, remove management profiles from internet-facing interfaces, and enable the Threat IDs Palo Alto lists (543004 and 97622 to 97625, content version 9162 or later).
- Our analysis: because the first attempt was seen on October 17, review web and management logs back to that date, not just from October 21.
What we still do not know
No source we reviewed has confirmed a successful compromise of a specific server. It is unclear how the attacker got details during the embargo, when Palo Alto’s fixed releases will ship, and which other vendors embed vulnerable PHP builds.
Sources: The Hacker News, October 21, 2026; Help Net Security, October 21, updated October 22, 2026; SecurityOnline, October 23, 2026.
Leave a Reply