Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products

Key Points:

• Palo Alto Networks confirmed two critical PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PAN-OS and previously impacting some cloud services, prompting planned firewall hotfixes and guidance to restrict management interface access.
• The vulnerabilities stem from unsafe memory handling in PHP’s error processing, allowing attackers to execute code remotely by exploiting out-of-memory errors and use-after-free memory references, with a high severity rating of 8.7 for PAN-OS products.
• Affected PAN-OS versions include 10.2, 11.1, 11.2, 12.1, and 12.2 on PA-Series and VM-Series firewalls, as well as Panorama deployments; exposure is limited to management web interfaces, while other Palo Alto products like Cloud NGFW and Prisma Cloud remain unaffected.
• Hotfixes for PAN-OS are scheduled for late October 2026, with administrators advised to restrict management interface access to trusted IPs or jump boxes until patches are available, as internet-facing management interfaces pose the highest risk.
• Threat prevention signatures are available to mitigate exploitation, but these should complement, not replace, installing official fixes; Palo Alto urges users to monitor updates and follow best practices for securing affected systems.