Palo Alto Networks Confirms PHP2Shell Flaws Impact PAN-OS, Urges Immediate Access Restrictions

Key points

• Palo Alto Networks confirmed that CVE-2026-109618 and CVE-2026-109619 affect PAN-OS versions 10.2 through 12.2 on PA-Series and VM-Series firewalls, as well as Panorama deployments.
• The vulnerabilities exploit PHP's handling of fatal errors, specifically out-of-memory conditions that leave uninitialized or stale memory references, enabling remote code execution via the management web interface.
• Palo Alto Networks rates the severity of these flaws on its products at 8.7 (High), noting that availability is the primary affected security property, though it is unaware of malicious exploitation against its specific products.
• Hotfixes for affected PAN-OS versions are scheduled for release between October 26 and October 30, 2026, with the earliest updates expected on October 26.
• Until patches are installed, administrators are advised to restrict access to management interfaces to trusted internal IP addresses or dedicated jump boxes to mitigate risk.
• The broader PHP2Shell vulnerabilities were discovered using AI tools, which significantly reduced the time required to develop exploits for flaws that had existed for over a decade.

Background

This incident follows the emergency patching of critical PHP vulnerabilities on October 21, 2026, which were leaked before their scheduled disclosure. The flaws, affecting approximately 70% of websites, prompted immediate action from security agencies and companies worldwide. Earlier coverage highlighted the rapid exploitation attempts and the urgency of isolating unpatched systems. Additionally, recent reports indicate that ransomware gangs have been exploiting other patched Palo Alto flaws, underscoring the ongoing threat landscape for network security appliances.

How outlets are covering it

Cyber Security News emphasizes the specific impact on Palo Alto Networks' products, detailing the affected versions, severity ratings, and mitigation steps. The Atlantic frames the event within a broader 'Black October' crisis, highlighting the unprecedented volume of security incidents and the potential for AI-powered hacks to reshape online security. Wiz.io focuses on the technical details of the PHP vulnerabilities, stressing the role of AI in discovering and exploiting long-standing flaws, and the need for immediate patching across the industry. CNN highlights the 22-year history of the PHP vulnerability and how AI tools made exploitation practical, raising concerns about the future of cybersecurity as AI lowers the barrier for attackers. The sources agree on the critical nature of the flaws but differ in emphasis: Palo Alto's specific product impact versus the broader industry-wide implications and the role of AI in accelerating vulnerability discovery and exploitation.

Why it matters

The confirmation of PHP2Shell vulnerabilities affecting Palo Alto Networks' PAN-OS products highlights the critical need for immediate patching and access restrictions to prevent potential remote code execution. The incident underscores the growing threat posed by AI-assisted vulnerability discovery, which can expose long-standing flaws in critical software, and the importance of proactive security measures in a rapidly evolving threat landscape.

What to watch

Palo Alto Networks is expected to release hotfixes for affected PAN-OS versions between October 26 and October 30, 2026. Administrators should monitor vendor updates, apply patches as soon as they are available, and continue to restrict management interface access to trusted networks until then. The broader security community is likely to see increased scrutiny of AI-assisted vulnerability discovery and exploitation, with potential implications for future security practices and policies.