Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products

Live updates

1. 1h ago

   Palo Alto Networks Confirms PHP RCE Vulnerabilities in PAN-OS

   Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PAN-OS and multiple network products. The company has released hotfixes and interim mitigation guidance for affected systems. Attackers are actively exploiting these vulnerabilities against publicly-accessible management interfaces.

   Why it matters

   These vulnerabilities are part of a larger issue affecting PHP, a widely-used scripting language for web servers and CMS systems. The PHP Foundation patched the vulnerabilities on October 21, 2026. Exploitation of these vulnerabilities can lead to unauthenticated remote code execution on affected systems.

   What is confirmed

   • CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP.
   • Palo Alto Networks has confirmed that the vulnerabilities affect PAN-OS and multiple network products.
   • The vulnerabilities allow attackers to achieve unauthenticated remote code execution on systems running affected versions of PHP.
   • The PHP Foundation patched the vulnerabilities on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
   • Attackers are actively exploiting the PHP2Shell vulnerabilities against publicly-accessible Palo Alto Networks management interfaces.

   What to watch next

   • Further updates on the scope of exploitation
   • Release of additional hotfixes for affected systems
   • Details on the impact of exploitation on affected networks
   Sources used for this update (18)

   1. wiz.io — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
   2. The Atlantic — The Safe Internet Is Shrinking
   3. WSJ — AI Hacks Are Coming Thick and Fast and Overwhelming the Internet
   4. The New York Times — The 5 Things You Need to Know About the PHP Security Flaw Breaking the Internet
   5. The Washington Post — Opinion | The best defense against bad AI is more good AI
   6. CyberSecurityNews — Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products
   7. 9News — Immediate software updates recommended for consumers after identification of PHP security issues
   8. cybersecuritynews.com — Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and ...
   9. securebulletin.com — Palo Alto Confirms PAN-OS Firewalls Exposed to Critical PHP ...
   10. thedailytechfeed.com — Palo Alto Confirms Critical PHP2Shell RCE in PAN-OS, Issues ...
   11. cyberwebspider.com — PHP Vulnerabilities in PAN-OS | Cyber Security News
   12. cyberinsider.co.uk — Palo Alto updates PHP vulnerability response as hotfixes ship
   confidence 100%