Palo Alto Networks has confirmed that a pair of critical remote-code-execution flaws in the PHP language runtime extend into its own PAN-OS firewall software and Panorama management platform, and that fixes won’t be fully available for roughly a week after the advisory update.

The two issues, tracked as CVE-2026-109618 and CVE-2026-109619, stem from how PHP handles severe internal errors through a function called longjmp(), which abruptly jumps program execution back to an earlier saved checkpoint. When that jump happens at the wrong moment, it can leave stale or uninitialized memory behind — memory that a later part of the program may then act on, opening a path for an attacker to run their own code.

Two Related but Distinct Flaws

CVE-2026-109618 is triggered when the server runs out of memory partway through handling a request, leaving that request’s memory in an incomplete state. If cleanup routines later operate on that incomplete memory, an attacker who can reliably force memory exhaustion may be able to turn the resulting instability into remote code execution.

CVE-2026-109619 is a related but separate issue involving global memory references that continue pointing at memory after it has already been freed. A subsequent request that reads or acts on one of those dangling references can again give an attacker a route to execute arbitrary code.

Both flaws trace back to the broader PHP vulnerability research effort published under the name “PHP2Shell,” which carries a CVSS v4.0 base score of 9.2. Palo Alto has assessed its own product-specific exposure slightly lower, at 8.7, and notes that for its products the primarily affected security property is availability rather than confirmed data theft or configuration tampering — though the company is careful to frame that as the current assessment, not a guarantee against more severe impact.

Scope: Management Interfaces, Not GlobalProtect

According to the updated advisory, the vulnerable surface is limited to PAN-OS management interfaces — the HTTPS administrative console and the XML API — rather than the data-plane components most organizations expose to end users. A dataplane interface is only affected if it has a management profile explicitly attached to it. Notably, GlobalProtect portals and gateways, Clientless VPN, and Captive Portal are all listed as unaffected, which should reduce panic for organizations whose remote-access infrastructure runs through those services.

Affected branches span a wide swath of PAN-OS releases, including 10.2, 11.1, 11.2, 12.1, and 12.2, running on PA-Series and VM-Series firewalls, as well as Panorama (including virtual and M-Series deployments). No unusual configuration is required to be vulnerable — any device on an affected branch with its management interface reachable is a candidate for exploitation.

Two cloud-delivered products, Cortex XCORE SaaS and WildFire Cloud, were also affected but have already received fixes, delivered on October 21 and October 22 respectively. Cloud NGFW, Cortex XDR, Cortex XSIAM, Prisma Cloud, Prisma Access, and the GlobalProtect App are all currently listed as unaffected by this issue.

Patches Are Still Coming

As of the October 24 advisory update, Palo Alto said it has no evidence of malicious exploitation against its own products — but that comes with an important caveat: security researchers at Unit 42 have already observed proof-of-concept exploit code circulating for the broader PHP2Shell vulnerabilities, meaning the gap between disclosure and active abuse could close quickly.

Firmware fixes are still on a rolling schedule rather than available today. The earliest hotfixes — versions 10.2.18-h13, 11.1.16-h4, and 11.2.10-h16 — are estimated for October 26, with PAN-OS 12.2.4-h1 targeted for October 28 and additional hotfixes planned through October 30. Palo Alto has emphasized that these dates are estimates and may shift.

What Administrators Should Do Now

• Restrict access to PAN-OS and Panorama management interfaces to trusted internal IP ranges or a dedicated jump host — internet-facing management interfaces represent the highest-risk configuration.
• Where possible, enable Threat Prevention coverage for this issue, which Palo Alto has tied to signature 543004 and subsequent content updates (versions 9162 through 9164 and later). Doing so requires routing management traffic through a dataplane port, configuring an inbound certificate, and enabling HTTPS decryption and inspection.
• Track each affected device’s specific hotfix path against Palo Alto’s advisory and Unit 42’s threat brief, since release timing varies by branch.
• Treat access restrictions as a stopgap, not a substitute for installing the fixed release once it becomes available for each platform.

The disclosure is a reminder that vulnerabilities in widely used runtimes like PHP don’t stay contained to web applications — they can resurface inside the management stacks of the very security appliances organizations rely on to keep attackers out.