Palo Alto PAN-OS Firewalls Attacked via PHP2Shell Flaws CVE-2026-109618 and CVE-2026-109619: Patch Now

TL;DR: Palo Alto Networks says attackers are exploiting the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, against PAN-OS firewalls and Panorama whose management interface is exposed to the internet. Hotfixes are out for every supported release line except one 11.1 line, due October 30. If you run a Palo Alto firewall, install the hotfix for your version and make sure its admin page and API aren’t reachable from the internet.

What happened

The flaws: CVE-2026-109618 and CVE-2026-109619 are the two critical bugs in PHP that the PHP project fixed on October 21, known as PHP2Shell. PAN-OS, the operating system on Palo Alto’s PA-Series and VM-Series firewalls and its Panorama management appliances, uses PHP in its management web interface, which includes the HTTPS admin pages and the XML API. Palo Alto says no special configuration is needed to be affected.

Exploitation: Palo Alto’s advisory, first published October 21 (US time) and last updated October 29, now says: “Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.” Palo Alto raised the issue to Critical with its highest urgency rating on October 27 (US time). It scores the issue 9.2 when the management interface is reachable from the internet, and 7.7 when access is limited to a jump box.

The fixes: Palo Alto released hotfixes line by line over the past week. The last batch, for 10.2.7, 10.2.10, 11.2.4, 12.1.4 and 12.1.10, was marked released on October 29 at 1:20 p.m. Manila time (05:20 UTC). The advisory still lists 11.1.7-h12 as expected on October 30; the alternative on that line is to move to 11.1.16-h4. Palo Alto says the same hotfix also fixes the Node.js Brotli flaw, except on 11.2.10, where you need h17 rather than h16.

What’s not affected: Palo Alto lists Cloud NGFW, Prisma Access and the GlobalProtect app as not impacted (WildFire Cloud was affected and fixed by Palo Alto on October 22), and says GlobalProtect portals and gateways, Clientless VPN and Captive Portal on PAN-OS are not impacted either. Only the management interface is, including any data interface with a management profile attached.

Why it matters

A firewall’s admin page is the keys to the network: whoever controls it can change rules, open remote access and watch traffic. Many small businesses run a Palo Alto firewall installed by a reseller or MSP and never check whether its admin page faces the internet. Our read: if yours does, this is a patch-today problem, because attacks are already happening and Palo Alto’s own scoring treats an exposed admin page as the worst case. For background on the PHP flaws themselves, see our PHP2Shell story; our Security hub tracks other urgent patches.

What to do now

1. Find your firewalls and their versions. Check every Palo Alto firewall and Panorama. If someone else manages them, ask today for the version and the patch date.
2. Install the hotfix for your line. Use the table above. On 11.2.10, go straight to h17. On 11.1.7, either wait for h12 (expected October 30) or move to 11.1.16-h4.
3. Close the admin page to the internet. Allow the management interface only from trusted internal addresses, and remove management profiles from internet-facing interfaces. Palo Alto says restricting access this way minimizes the risk, in line with its best-practice deployment guidelines.
4. Check for signs of attack. Our advice: if the admin page was exposed, review admin logins, configuration changes and accounts since October 17 (when AWS first saw PHP2Shell attempts), then change admin passwords and API keys after patching.

Updates

• Oct 29, 2026, 7:40 p.m. Manila: First published.

Sources & method

Sources

• Palo Alto Networks security advisory CVE-2026-109618, “Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products” (published Oct 21, updated Oct 29, 2026)
• Palo Alto Networks advisory data (CVE JSON)
• Unit 42, “Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619” (updated Oct 25, 2026)
• CISA Known Exploited Vulnerabilities catalog (version 2026.10.28; both CVEs added Oct 26, 2026)
• AWS Security Blog, “Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot,” Oct 21, 2026

Method. Checked October 29, 2026, at about 7:00 p.m. Manila time (11:00 UTC). The exploitation statement, affected products, fixed hotfixes, the October 30 estimate, the scores, the Brotli note and the mitigations come from Palo Alto’s advisory and its timeline; the release time of the last hotfix batch comes from the advisory’s timeline entry. We checked CISA’s KEV catalog (version 2026.10.28). The October 17 date comes from AWS’s report of the first PHP2Shell attempts it saw; Palo Alto doesn’t say when attacks on its devices began. Steps labelled “our advice” and “our read” are our own judgment, not Palo Alto’s. The thumbnail is the image from Palo Alto’s Unit 42 threat brief on these flaws. No affiliate links on this page. How we work.