Palo Alto Confirms PHP2Shell Vulnerabilities Affect PAN-OS and Panorama

Palo Alto Networks has confirmed that its PAN-OS operating system and Panorama management platform are affected by two critical vulnerabilities in PHP, raising fresh concerns about the security of internet-connected infrastructure. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are collectively known as PHP2Shell and could allow attackers to execute malicious code remotely without authentication under vulnerable conditions. The security flaws affect the PHP runtime itself rather than a specific website or application built with PHP. According to cybersecurity researchers, more than 22.6 million internet-exposed instances may be vulnerable, although that figure represents potentially exposed systems rather than confirmed successful attacks. Palo Alto Networks has published guidance for customers while preparing further information about affected product versions and software fixes.

The PHP2Shell vulnerabilities involve weaknesses in memory management and error handling. Under certain conditions, these flaws can leave memory improperly initialised or allow software to reference memory that has already been released. An attacker who successfully exploits the weaknesses may be able to execute arbitrary code on an affected server, potentially gaining a foothold for further malicious activity. The vulnerabilities are particularly concerning because exploitation may occur before an application-level security check is reached in some configurations. PHP is widely used to operate websites, content-management systems and business applications, meaning the weaknesses could affect organisations across multiple industries. Security authorities have therefore urged administrators to identify vulnerable installations and install the appropriate security updates without delay.

Palo Alto Networks has listed PAN-OS and Panorama as affected products, while several other products in its portfolio have been identified as unaffected. At the time of the company’s advisory covered by recent reporting, fixed PAN-OS releases were still pending. The company recommended restricting access to management interfaces so that only trusted internal addresses can connect, reducing the opportunity for unauthorised parties to reach vulnerable services. It also highlighted the importance of using available threat-prevention protections to detect and block known exploitation attempts. However, network restrictions and security signatures are temporary risk-reduction measures; they do not eliminate the underlying software vulnerabilities. Organisations must continue monitoring Palo Alto Networks’ official advisories for updated remediation instructions and confirmed release information.

The incident has also prompted wider concern across the cybersecurity industry. Fortinet and Cisco have been assessing whether their own products and services are affected, although their investigations have not produced the same confirmed exposure status described in Palo Alto Networks’ advisory. Researchers have also reported the appearance of proof-of-concept exploit code online, increasing concerns that attackers may attempt to use the vulnerabilities against exposed systems. Palo Alto Networks’ Unit 42 threat-intelligence team reported observing an incident in which attackers used AI-agent-style techniques during post-exploitation activity against a European government entity. The reported activity included attempts to obtain authentication information and move further into the target’s network. These observations highlight how attackers can combine software vulnerabilities with automated techniques to accelerate reconnaissance and pursue additional access after an initial compromise.

Security specialists recommend that organisations immediately review their PHP installations, prioritise internet-facing systems, apply the relevant security patches and investigate suspicious activity. The PHP Security Team has released fixed versions including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for the affected release branches, although administrators should confirm the appropriate update for their environment and any vendor-specific packages. Organisations running older, unsupported PHP versions should consult their operating-system or software vendors for available security fixes. Businesses should also review server logs for unexpected process execution, unusual PHP worker behaviour, suspicious file creation and unexplained outbound connections. The PHP2Shell incident reinforces the importance of rapid vulnerability management, accurate asset inventories and layered security controls, particularly for systems that manage sensitive information or provide access to critical infrastructure.