[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQo-Owvy88zQ2R8L4O9TzZPGIq58gKswBK2I7ghUzcsY":3},{"article":4,"iocs":47,"watch_terms":54,"solutions":55,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"3a41d653-9113-4ae3-ac14-2e3b8276e934","Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products","palo-alto-confirms-php-rce-vulnerabilities-impact-pan-os-and-multiple-network-pr-22d0b9","Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have prompted planned firewall hotfixes and guidance to restrict access to management interfaces. The company updated its security advisory on October 24, 2026. It said it was […] The post Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products appeared first on Cyber Security News.","Palo Alto Networks has confirmed two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting PAN-OS and several network products. These flaws, stemming from PHP's error handling, allow for remote code execution and have a high severity rating. While the company is unaware of active exploitation, proof-of-concept exploits for the underlying PHP2Shell vulnerabilities exist. Hotfixes are planned, and temporary mitigation includes restricting access to management interfaces.","Palo Alto Networks confirms critical RCE vulnerabilities in PAN-OS, impacting firewalls and network products.","https:\u002F\u002Fcybersecuritynews.com\u002Fpalo-alto-confirms-php-rce-vulnerabilities\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FPalo-Alto-Confirms-PHP-RCE-Vulnerabilities.webp","2026-10-24T06:41:29+00:00","2026-10-24T07:00:14.004708+00:00",9,[17,20,23,26],{"name":18,"type":19},"Palo Alto Networks","vendor",{"name":21,"type":22},"PAN-OS","product",{"name":24,"type":25},"PHP","technology",{"name":27,"type":28},"PHP2Shell","campaign","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,40,42],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52],{"type":49,"value":50,"context":51},"cve","CVE-2026-109618","PHP RCE vulnerability in PAN-OS",{"type":49,"value":53,"context":51},"CVE-2026-109619",[18,21],{"controls":56,"vendors":139},[57,86,111],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":87,"name":88,"problem":89,"products":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",[91,95,103],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":87,"product_name":92,"url":93,"description":94},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":112,"name":113,"problem":114,"products":115},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","secure-firewall","Cisco Secure Firewall","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Ffirewalls\u002Findex.html","Next-generation firewalls with intrusion prevention, using Talos threat intelligence.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"clavister","Clavister","\u002Fvendor-logos\u002Fclavister.png","clavister-netwall","Clavister NetWall","https:\u002F\u002Fwww.clavister.com\u002Fproducts\u002Fclavister-netwall\u002F","Next-generation firewalls developed in Sweden.",{"vendor_slug":133,"vendor_name":18,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"palo-alto-networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","next-generation-firewall","Next-Generation Firewalls","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fnetwork-security\u002Fnext-generation-firewall","Hardware, virtual and cloud firewalls running PAN-OS, with intrusion prevention.",[140],{"slug":133,"name":18,"logo_path":134,"roles":141},[142,143],"affected","reported_by",{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":156},"critical-php-rce-flaws-expose-pan-os-and-network-products-to-remote-takeover","Critical PHP RCE Flaws Expose PAN-OS and Network Products to Remote Takeover","Two critical remote code execution vulnerabilities in PHP's error handling were found to affect Palo Alto's PAN-OS and multiple network products, meaning a widely-used third-party component introduced serious risk into enterprise security infrastructure. While patches are not yet fully available, proof-of-concept exploits already exist in the wild, dramatically shortening the window for defenders to act. This incident highlights how vulnerabilities in upstream dependencies can cascade into critical network appliances that organizations rely on for perimeter defense. The stakes are especially high here because compromising a firewall or network security device can give attackers a privileged position from which to attack the entire internal network.",[149,150,151,152,153,154,155],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":157,"PCI DSS Requirement 6":158,"NIST SP 800-53 SI-2: Flaw Remediation":159,"OWASP A06:2021 Vulnerable and Outdated Components":160,"CIS Control 7: Continuous Vulnerability Management":161,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":162,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":163},"NIS2 requires essential entities to implement policies on incident handling and vulnerability management; operators of critical network infrastructure must have processes to rapidly respond to high-severity flaws like these before exploitation occurs.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities through timely patching; network devices processing or protecting cardholder data environments must be patched against critical RCE flaws on a strict schedule.","SI-2 requires organizations to identify, report, and correct information system flaws; having a formal flaw remediation process would ensure hotfixes for these critical RCE vulnerabilities are applied on an urgent, tracked timeline.","The root of these vulnerabilities is a flawed PHP component embedded in PAN-OS, a textbook example of the risk OWASP A06 warns against when third-party libraries are not tracked, assessed, and updated systematically.","Regularly scanning network appliances and tracking vendor advisories for third-party component CVEs like these PHP flaws would ensure organizations are aware of exposure and can prioritize patching before exploits mature.","This control requires timely identification and remediation of technical vulnerabilities in software components, which directly addresses the failure to account for risky upstream dependencies like PHP embedded in network security products.","Palo Alto's own recommended interim mitigation is restricting management interface access, which aligns with this control's requirement to limit access to critical systems to authorized and verified sources only."]