CVE-2026-109618: PHP2Shell Hits All PAN-OS Versions
CVE-2026-109618 PHP2Shell affects all PAN-OS and Panorama versions; no patch available yet.
Palo Alto Networks confirmed that PHP2Shell (CVE-2026-109618 and CVE-2026-109619), a pair of critical PHP memory-handling vulnerabilities rated 9.2 CVSS, affects all supported versions of PAN-OS 10.2–12.2 and all Panorama versions with no fixes yet available. The flaws are reachable only through the management web interface (HTTPS UI and XML API) and require no special configuration to exploit. Attackers have been probing production systems since before disclosure, though successful exploitation has not yet been confirmed.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Palo Alto Networks?
Get an email when a new story names Palo Alto Networks, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Next-generation firewall and intrusion prevention
Malicious traffic is blocked at the network edge and between zones.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-109618
- cve — CVE-2026-109619