Palo Alto Networks confirms PHP2Shell attacks on PAN-OS firewalls
The vendor rated the flaw at 9.2 on the CVSS 4.0 scale and urged customers to install fixed PAN-OS releases and restrict external access.
Palo Alto Networks confirmed that attacks exploiting two PAN-OS vulnerabilities known as PHP2Shell are taking place in the wild, according to dailysecu.com. The company updated its security advisories on October 28-29, 2026 to flag the active exploitation of CVE-2026-109618 and CVE-2026-109619.
The two flaws allow unauthenticated remote code execution through a memory handling error, and they sit in the web management interface used for firewall security policy settings and system management. Palo Alto Networks rates the risk to its products at 9.2 on the CVSS 4.0 scale and has set its response urgency to the highest level.
Affected versions and fixes
Some versions of the PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 series are affected, along with PA-series and VM-series firewalls and Panorama. GlobalProtect portals and gateways and clientless VPN are not affected, according to the vendor.
Fixed versions being provided include PAN-OS 12.2.4-h1, 12.1.7-h11, 11.2.10-h16, 11.1.4-h38 and 10.2.18-h13. Palo Alto Networks said it is also providing threat prevention signatures to detect related attacks, and it urged customers to patch and restrict external access to the management interface.
Quick answers
Which PAN-OS versions are affected by PHP2Shell?
Some versions of the PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 series, along with PA-series and VM-series firewalls and Panorama, according to Palo Alto Networks.
Which PAN-OS versions fix the vulnerabilities?
The fixed releases listed by the vendor are PAN-OS 12.2.4-h1, 12.1.7-h11, 11.2.10-h16, 11.1.4-h38 and 10.2.18-h13.
Are GlobalProtect portals and gateways affected?
No. Palo Alto Networks says GlobalProtect portals and gateways and clientless VPN are not affected.