Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have prompted planned firewall hotfixes and guidance to restrict access to management interfaces.
The company updated its security advisory on October 24, 2026. It said it was not aware of malicious exploitation against its products. However, Unit 42 has seen proof-of-concept exploits for the wider PHP vulnerabilities, known as PHP2Shell.
PHP RCE Vulnerabilities
Both flaws involve PHP’s handling of serious errors through longjmp(), a function that transfers program execution to an earlier saved point. Unsafe memory left behind during this process can allow attackers to run code remotely.
CVE-2026-109618 occurs when an out-of-memory error interrupts request handling and leaves request memory uninitialized. Later cleanup operations may use that incomplete memory. Attackers can trigger memory exhaustion to reach this unsafe state and achieve remote code execution.
CVE-2026-109619 involves global memory references that continue pointing to memory after it has been freed. Later requests may read or act on those stale references, creating another path to execute attacker-controlled code.
The underlying PHP vulnerabilities carry a CVSS 4.0 score of 9.2. Palo Alto rates the impact on its products at 8.7, or high severity. Its product-specific assessment identifies availability as the affected security property, rather than confirming data theft or unauthorized changes.
Affected PAN-OS Versions and Services
Affected branches include PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 on PA-Series and VM-Series firewalls. Panorama deployments, including virtual and M-Series systems, are also affected. No special configuration is needed for the software to be vulnerable.
Exposure is limited to the management web interface, covering the HTTPS administration console and XML API. A dataplane interface is affected only when it has a management profile attached. GlobalProtect portals, gateways, Clientless VPN, and Captive Portal are not impacted.
Cortex XCORE SaaS and WildFire Cloud were previously affected, but received fixes on October 21 and October 22, respectively. Cloud NGFW, Cortex XDR, Cortex XSIAM, Prisma Cloud, Prisma Access, and the GlobalProtect App are among the products currently listed as unaffected.
PAN-OS fixes remain scheduled rather than available as of October 24. The earliest estimated releases are 10.2.18-h13, 11.1.16-h4, and 11.2.10-h16 on October 26. PAN-OS 12.2.4-h1 is expected October 28, with other listed hotfixes planned through October 30. These dates remain estimates.
Until patches arrive, administrators should limit management access to trusted internal IP addresses or a dedicated jump box. Internet-facing management interfaces present the highest risk. Earlier reporting on RedTail exploiting Palo Alto firewalls and ransomware targeting VPN appliances covers separate threats, not confirmed PHP2Shell attacks against PAN-OS.
Threat Prevention coverage includes signature 543004 and additional signatures delivered through content versions 9162, 9163, and 9164 onward. Protection requires routing management traffic through a dataplane port, configuring the inbound certificate, decrypting HTTPS traffic, and enabling threat prevention inspection.
Administrators should follow the vendor’s release updates and Unit 42 threat brief, verify their exact hotfix path, and treat access restrictions as temporary safeguards, not replacements for installing the fixed PAN-OS release once available.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
