CVE-2026-109618 / CVE-2026-109619, Palo Alto Networks PAN-OS and Panorama: the PHP2Shell flaws affect the management web interface of every release, with no fixed release on any train

Palo Alto Networks' advisory of 2026-10-21 lists every release of PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 and of Panorama as affected by CVE-2026-109618 and CVE-2026-109619, with no fixed release and every fix estimate shown as TBD (Palo Alto Networks, 2026-10-21). The two flaws are the unauthenticated remote-code-execution bugs in the PHP runtime that the PHP project fixed in its releases of the same day (PHP, 2026-10-21). Palo Alto says no special configuration is required to be affected, that the issue strictly affects the management web interface, which includes the HTTPS web UI and the XML API service, and that a dataplane interface is affected only where a management profile is attached to it (Palo Alto Networks, 2026-10-21). It states that the GlobalProtect portal and gateway and the captive portal are not impacted (Palo Alto Networks, 2026-10-21).

Palo Alto describes the flaws as remote code execution but scores their impact on its own product CVSS-B 8.7 (severity high, urgency moderate), with high availability impact and none on confidentiality or integrity, against a vendor-level 9.2 with high impact on all three, and says the risk is highest where management access is allowed from external addresses on the internet; restricting management to a single jump box lowers its rating to 7.1, and it is not aware of any malicious exploitation against its products (Palo Alto Networks, 2026-10-21). Unit 42 says it has seen proof of concept of the PHP flaws (Unit 42, 2026-10-21). Until fixes ship, Palo Alto recommends restricting management access to trusted internal addresses and offers Threat Prevention coverage (Threat IDs 543004, 97622, 97623, 97624 and 97625, Applications and Threats content version 9162 and later) that protects only management traffic routed through a dataplane interface, sent to a replaced inbound-management certificate, decrypted so the firewall can inspect it, and covered by threat prevention (Palo Alto Networks, 2026-10-21).