Palo Alto Networks Confirms PHP2Shell Flaws Affect PAN-OS and Panorama

TL;DR

Palo Alto Networks confirmed that the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, affect PAN-OS, Panorama and WildFire WF-500 appliances. The PAN-OS PHP2Shell risk sits in the management web interface. Hotfixes are rolling out, and Threat Prevention signatures are available now.

Why It Matters

Attackers are already exploiting PHP2Shell broadly, according to Amazon Threat Intelligence. PAN-OS management interfaces have also drawn attacks before. In November 2024, CISA added two of them, CVE-2024-0012 and CVE-2024-9474, to its KEV catalog. So any firewall that exposes its web UI to the internet needs fast attention.

Palo Alto rates the issue CVSS 8.7 when the management interface faces the internet and 7.1 when access is limited to an adjacent network.

How the Attack Works

Both bugs sit in PHP’s error handling. According to the Palo Alto Networks advisory for CVE-2026-109618, the first flaw leaves “request memory uninitialized,” allowing attackers to “reliably achieve RCE using out-of-memory (OOM) triggers.” The second leaves global memory “pointing to freed memory regions” that later requests can reuse.

On PAN-OS, the flaws are reachable only through the management interface, including the web UI and XML API, according to coverage of the advisory. A dataplane interface becomes exposed if it carries a management profile. However, the GlobalProtect portal and gateway are not affected.

Exploitation status

Palo Alto says it is “not aware of any malicious exploitation of this issue against our products.” Neither CVE appears in CISA’s KEV catalog yet.

Affected Products

• PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2
• Panorama
• WildFire Appliance WF-500 and WF-500-B

Cloud NGFW, Prisma Access, GlobalProtect App, Cortex products, Strata Cloud Manager and WildFire Cloud are not affected.

Patch and Mitigation Steps

Palo Alto’s October 22 update added hotfix targets for each branch, including PAN-OS 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4 and 10.2.18-h13. Check the advisory for your exact release and its availability date.

• Restrict the management interface to trusted internal IP addresses or a jump host.
• Remove management profiles from internet-facing dataplane interfaces.
• Enable Threat IDs 543004, 97622, 97623, 97624 and 97625, with content version 9162 or later.

Note that these signatures only inspect traffic that passes through the dataplane. They do not protect a directly exposed out-of-band management port. As a result, the PAN-OS PHP2Shell exposure depends mostly on how admins reach the firewall. Until hotfixes land, locking down management access remains the best defense against PAN-OS PHP2Shell attacks.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.