Palo Alto Confirms PHP RCE Flaws | JQJO

Palo Alto Networks confirmed two critical PHP remote code execution vulnerabilities, CVE‑2026‑109618 and CVE‑2026‑109619, that affect PAN‑OS and previously impacted two cloud services. The flaws, tracked as PHP2Shell, involve PHP’s handling of serious errors through longjmp(), allowing attackers to trigger memory exhaustion or stale references to execute code remotely. The vulnerabilities carry a CVSS 4.0 score of 9.2, with Palo Alto rating the impact on its products at 8.7, or high severity. Affected PAN‑OS branches include 10.2, 11.1, 11.2, 12.1, and 12.2 on PA‑Series and VM‑Series firewalls, as well as Panorama deployments. Exposure is limited to the management web interface, covering the HTTPS administration console and XML API. The company updated its advisory on October 24, 2026, noting no known malicious exploitation but providing guidance to restrict access to management interfaces. Cortex XCORE SaaS and WildFire Cloud were previously affected but received fixes on October 21 and October 22, respectively. The company has planned firewall hotfixes for the affected versions.