Summary
- The exposure concerns selected PAN-OS and Panorama management interfaces, not GlobalProtect.
- Hotfix builds 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 had shipped by 25 October.
- WildFire appliances are not affected, and the vendor has not confirmed product exploitation.
Palo Alto Networks has released several hotfixes addressing the impact of critical PHP vulnerabilities on its firewall management software, while additional PAN-OS builds remain scheduled for release during the final week of October.
The vendor's security advisory, first issued on 21 October and updated on 25 October 2026, identifies exposure involving CVE-2026-109618 and CVE-2026-109619 in specified PAN-OS versions and Panorama management deployments.
The two upstream PHP weaknesses can permit remote code execution in vulnerable configurations. Palo Alto Networks assesses the potential impact in its product as high severity, assigning a CVSS v4.0 score of 8.7 when a management interface is reachable from the network.
The affected functionality is the management web interface, including the HTTPS administration service and XML API. GlobalProtect portals, gateways and Clientless VPN are not affected by this PHP advisory, according to the vendor.
The scope differs from initial product-impact assumptions. Palo Alto Networks now identifies the WildFire WF-500 and WF-500-B appliances as unaffected; its WildFire Cloud service was remediated separately on 22 October. Cortex XCORE's previously affected SaaS component was remediated on 21 October.
The company removed estimated availability dates for PAN-OS 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 from its release table on 25 October because those fixed builds had already shipped. Other targeted maintenance releases retained estimated dates from 27 to 30 October.
These distinctions matter for organisations with mixed firewall estates. Some deployments may already have an applicable release, while devices on different supported branches still need interim protection and further software updates.
Palo Alto Networks rates the exposure highest where management interfaces can be reached directly from external internet addresses. Restricting administrative connectivity to trusted systems, including a designated jump host, reduces the accessible attack surface.
The vendor states that this change can lower its product-specific severity assessment, but it does not remove the underlying software weakness from affected devices. Access restrictions and content-based protections are interim measures while applicable fixed releases are deployed.
Threat Prevention subscriptions can provide detection coverage through published signatures, although customers must ensure the relevant inspection path is configured correctly. Traffic directed to management services may need routing through an inspected data-plane interface and suitable inbound decryption arrangements.
Having a subscription without those conditions does not necessarily mean management traffic is inspected. The advisory provides specific requirements that customers must compare with their own firewall configuration.
The issue is distinct from the PAN-OS VPN authentication bypass previously reported in Cyber Insider, which was linked to ransomware activity against some organisations. Evidence from that separate attack campaign does not prove exploitation of these PHP vulnerabilities in Palo Alto products.
Palo Alto Networks says it is not aware of malicious exploitation of the current issue against its products. This statement does not contradict reports of working PHP2Shell attacks against other vulnerable PHP deployments, because the affected products and configurations differ.
Although firewalls are designed to protect enterprise networks, their management interfaces run software dependencies that require maintenance. Organisations using central administration platforms may also need to update Panorama independently of the appliances it manages.
A mixed environment can complicate remediation because software branches and deployment requirements differ across physical firewalls, virtual machines and management servers. Administrators also need to avoid interrupting production connectivity or remote access while applying changes.
The release table distinguishes fixed software already available from builds marked with a future estimated availability date; those estimates are not evidence that the promised release has shipped.
The 25 October advisory provides released builds, planned releases and workaround requirements. It remains the authoritative product-specific source for determining whether a particular PAN-OS version is affected and which corrected build applies. The vendor has not announced confirmed attacks against its affected products.
