Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products
Palo Alto Networks confirms critical RCE vulnerabilities in PAN-OS, impacting firewalls and network products.
Palo Alto Networks has confirmed two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting PAN-OS and several network products. These flaws, stemming from PHP's error handling, allow for remote code execution and have a high severity rating. While the company is unaware of active exploitation, proof-of-concept exploits for the underlying PHP2Shell vulnerabilities exist. Hotfixes are planned, and temporary mitigation includes restricting access to management interfaces.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Palo Alto Networks?
Get an email when a new story names Palo Alto Networks, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTwo critical remote code execution vulnerabilities in PHP's error handling were found to affect Palo Alto's PAN-OS and multiple network products, meaning a widely-used third-party component introduced serious risk into enterprise security infrastructure. While patches are not yet fully available, proof-of-concept exploits already exist in the wild, dramatically shortening the window for defenders to act. This incident highlights how vulnerabilities in upstream dependencies can cascade into critical network appliances that organizations rely on for perimeter defense. The stakes are especially high here because compromising a firewall or network security device can give attackers a privileged position from which to attack the entire internal network.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Next-generation firewall and intrusion prevention
Malicious traffic is blocked at the network edge and between zones.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-109618
- cve — CVE-2026-109619