Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS

Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have prompted planned firewall hotfixes and guidance to restrict access to management interfaces.

The core vulnerabilities—officially cataloged as CVE-2026-109618 and CVE-2026-109619—originate in how the PHP runtime manages memory during fatal error conditions. According to Cybersecuritynews, the first flaw occurs when out-of-memory errors interrupt request processing, leaving request memory uninitialized while control flow relies on PHP's internal error-handling functions. Subsequent cleanup operations can inadvertently interact with this incomplete memory, granting external attackers a reliable path to execute arbitrary code via crafted memory exhaustion triggers.

Media additions

Palo Alto Networks Patches 13 PAN-OS Vulnerabilities

CVE-2026-109619 involves global memory references that continue pointing to memory after it has been freed. Later requests may read or act on those stale references, creating another path to execute attacker-controlled code.

Affected branches include PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 on PA-Series and VM-Series firewalls. Panorama deployments, including virtual and M-Series systems, are also affected. No special configuration is needed for the software to be vulnerable.

Exposure is limited to the management web interface, covering the HTTPS administration console and XML API. A dataplane interface is affected only when it has a management profile attached. GlobalProtect portals, gateways, Clientless VPN, and Captive Portal are not impacted.

Industry observers and threat intelligence teams have tracked active probing across the broader internet. Commercial honeypots and cloud Security providers registered thousands of exploitation attempts immediately following the public disclosure of the PHP2Shell flaws. While independent researchers have demonstrated functional exploits against raw PHP environments and common web frameworks, Palo Alto Networks maintains that it has observed zero successful exploitation attempts targeting its own network appliances.

Until patches arrive, administrators should limit management access to trusted internal IP addresses or a dedicated jump box. Internet-facing management interfaces present the highest risk. Earlier reporting on RedTail exploiting Palo Alto firewalls and ransomware targeting VPN appliances covers separate threats, not confirmed PHP2Shell attacks against PAN-OS.

Pending the rollout of official software hotfixes, security experts recommend that businesses review their exposure across all embedded systems and enterprise appliances. For broader organizational context on software supply chain security and related corporate disclosures, readers can consult AllMind's financial and market updates or review ongoing Worldnewsflow coverage. Additional analysis of enterprise risk management can be found through standard guidance frameworks where applicable to operational continuity.

What to Watch Next

• Monitor the official Palo Alto security advisory portal for the deployment of scheduled PAN-OS hotfix releases, which are rolling out incrementally through the end of October 2026.
• Verify that management interfaces are shielded behind internal jump boxes or restricted subnets rather than relying solely on virtual patching layers.
• Audit auxiliary enterprise assets and third-party network appliances that may silently bundle vulnerable PHP runtime binaries.