Palo Alto Networks patches critical PHP RCE in PAN-OS, multiple products

Key Takeaways

• Palo Alto Networks has identified two critical PHP remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting its PAN-OS firewall software and previously impacting two cloud services.
• These flaws could allow attackers to execute arbitrary code remotely by exploiting PHP’s error handling within the management web interface.
• While fixes for cloud services have been deployed, patches for PAN-OS are currently scheduled for release between October 26 and October 30, 2026.
• The company has not observed active exploitation in its products, but proof-of-concept exploits for the underlying PHP vulnerabilities exist.
• Immediate mitigation involves restricting access to the management interface to trusted internal networks.

Critical PHP Flaws Threaten Palo Alto Networks PAN-OS

Palo Alto Networks has confirmed the existence of two critical remote code execution (RCE) vulnerabilities within the PHP components of its PAN-OS operating system, affecting a range of its firewall products. These flaws, identified as CVE-2026-109618 and CVE-2026-109619, carry serious implications for network security, potentially allowing unauthorized code execution through the management interface. While the company has not detected active exploitation in the wild against its products, it acknowledges the existence of proof-of-concept exploits for the broader PHP vulnerabilities, known as PHP2Shell.

The vendor updated its security advisory on October 24, 2026, outlining the scope of the issue and the planned hotfix schedule. Although specific Palo Alto Network products had previously been affected, fixes for Cortex XCORE SaaS and WildFire Cloud were successfully deployed on October 21 and October 22, respectively. However, hotfixes for PAN-OS are still pending release.

Details of the PHP RCE Vulnerabilities

Both vulnerabilities stem from how PHP manages critical errors, specifically through the longjmp() function. This function is designed to transfer program execution to a previously saved state. However, the flaws arise when this process leaves behind unsafe or uninitialized memory, which can then be manipulated by an attacker to execute arbitrary code remotely.

CVE-2026-109618 specifically occurs when an out-of-memory error disrupts the handling of a request. This interruption can leave the request’s memory in an uninitialized state. Subsequent cleanup operations might then attempt to use this compromised memory. Attackers can intentionally trigger memory exhaustion to force the system into this vulnerable state, ultimately achieving remote code execution.

CVE-2026-109619 involves global memory references that persist even after the memory they point to has been deallocated (freed). Later requests can then read from or operate on these “stale” references, providing another avenue for an attacker to inject and execute their own code.

The underlying PHP vulnerabilities have been assigned a CVSS 4.0 score of 9.2, indicating critical severity. Palo Alto Networks, however, assesses the impact on its specific products at 8.7, categorizing it as high severity. The company’s product-specific analysis points to availability as the primary affected security property, rather than confirming data exfiltration or unauthorized modifications.

Affected PAN-OS Versions and Services

The vulnerabilities impact several PAN-OS branches, including versions 10.2, 11.1, 11.2, 12.1, and 12.2, affecting both PA-Series and VM-Series firewalls. Panorama deployments, encompassing virtual systems and M-Series hardware, are also vulnerable. Importantly, these software versions are susceptible without any specific configuration.

Exposure to these flaws is confined to the management web interface, which includes the HTTPS administration console and the XML API. A dataplane interface is only at risk if a management profile is explicitly attached to it. Products and services such as GlobalProtect portals, gateways, Clientless VPN, and Captive Portal remain unaffected. Furthermore, Cloud NGFW, Cortex XDR, Cortex XSIAM, Prisma Cloud, Prisma Access, and the GlobalProtect App are currently listed as not impacted.

As of October 24, 2026, PAN-OS fixes remain scheduled. The earliest anticipated releases include 10.2.18-h13, 11.1.16-h4, and 11.2.10-h16, expected on October 26. PAN-OS 12.2.4-h1 is slated for October 28, with other hotfixes planned through October 30. These dates are subject to change.

Palo Alto Networks offers Threat Prevention coverage through signature 543004 and additional signatures delivered with content versions 9162, 9163, and 9164 and later. Effective protection requires routing management traffic through a dataplane port, configuring the inbound certificate, decrypting HTTPS traffic, and enabling threat prevention inspection.

What You Should Do

• Immediately restrict access to all management web interfaces of affected PAN-OS devices. Limit access to only trusted internal IP addresses or dedicated jump boxes. Internet-facing management interfaces pose the highest risk.
• Monitor the official Palo Alto Networks security advisory for the precise release schedule of hotfixes for your specific PAN-OS version.
• Once available, apply the relevant hotfixes for your PAN-OS deployment as soon as possible. Consider these patches as mandatory, not optional.
• Review and ensure your Threat Prevention coverage is up-to-date, specifically checking for signature 543004 and content versions 9162, 9163, and 9164 or higher.
• If not already configured, route management traffic through a dataplane port, configure the inbound certificate, decrypt HTTPS traffic, and enable threat prevention inspection for management traffic.
• Consult the Unit 42 threat brief for additional technical details and guidance.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.