Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products
Palo Alto Networks has identified two critical PHP remote code execution vulnerabilities affecting its PAN-OS firewall software and other network products. While no active exploitation has been reported, the company has issued guidance to restrict access to management interfaces to mitigate risks.
Why it matters
Critical vulnerabilities in enterprise-grade network security products pose significant risks to global infrastructure and require immediate patching by IT administrators.
Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have prompted planned firewall hotfixes and guidance to restrict access to management interfaces.
The company updated its security advisory on October 24, 2026. It said it was not aware of malicious exploitation against its products. However, Unit 42 has seen proof-of-concept exploits for the wider PHP vulnerabilities, known as PHP2Shell .
Both flaws involve PHP’s handling of serious errors through longjmp(), a function that transfers program execution to an earlier saved point. Unsafe memory left behind during this process can allow attackers to run code remotely.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in