PHP2Shell Reaches Palo Alto Firewalls: The First PAN-OS Hotfixes Are Listed, Most Arrive by October 30, and the Management Interface Is the Door to Close Now
Palo Alto Networks has confirmed that the two critical PHP2Shell flaws affect the management web interface of PAN-OS firewalls and Panorama. Today’s advisory update shows the first hotfixes without a pending date, with the rest due between October 27 and 30. Here is a status board for small IT teams.
Last week the PHP project rushed out fixes for two critical bugs nicknamed PHP2Shell. The question many firewall owners asked next was whether their own security appliances were exposed, since plenty of network gear runs PHP behind its web console. For Palo Alto Networks customers the answer is now clear: yes, through the management interface, and the hotfixes are arriving on a staggered schedule this week.
This briefing is based on Palo Alto Networks’ security advisory for CVE-2026-109618 and CVE-2026-109619, which the company updated on October 25, with background from Defender Daily’s report on the vendor’s confirmation.
Status board
- What is affected: PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). The exposure is the management web interface and XML API, which use PHP.
- What is not affected: Palo Alto lists Cloud NGFW, Prisma Access, the GlobalProtect app and the Cortex product line as unaffected. On October 23 it corrected the status of the WildFire WF-500 and WF-500-B appliances to not affected, and it says WildFire Cloud was patched on the vendor side.
- Exploitation: The advisory does not report attacks against PAN-OS. Separately, Check Point has said it has seen attempts to exploit PHP2Shell in general at about 10% of organizations worldwide since the flaws leaked, without saying whether any succeeded.
- Severity: Palo Alto scores the risk highest when the management interface can be reached from the internet, and lower when access is limited to a jump box or trusted internal addresses.
- Hotfixes: In today’s update, Palo Alto removed the estimated dates for three hotfixes, 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16, which suggests they are now available. The remaining hotfixes across the 10.2, 11.1, 11.2, 12.1 and 12.2 branches carry estimated dates from October 27 to October 30.
- Related PHP bug: Palo Alto says a third PHP flaw announced later, CVE-2026-115560, does not affect PAN-OS because it involves a configuration PAN-OS does not use.
Where the risk actually sits
The vulnerable code is reached through the firewall’s own administration console, not through the traffic it inspects. Palo Alto’s FAQ says GlobalProtect portals and gateways, clientless VPN and captive portal pages are not affected. A regular data interface becomes a risk only if an interface management profile has been attached to it, which turns that interface into another way into the console.
The company has also published threat prevention signatures for the flaws. They only help if management traffic passes through a data port where it can be decrypted and inspected, which is not how most small networks are built, so treat them as a supplement rather than a fix.
Your checklist for this week
- Confirm that no firewall or Panorama management interface is reachable from the internet. Limit it to a short list of trusted internal addresses or a management jump host.
- Check every data interface for an attached management profile, and remove any that are not needed.
- Look up your exact PAN-OS version in the advisory table, note the hotfix that applies to your branch and plan the maintenance window for its date.
- Apply the hotfix as soon as it is posted for your branch, then confirm the running version after the reboot.
- Review administrator logins and configuration changes since October 21 for anything you did not make.
What this means for your company
A firewall protects everything behind it, so its own console should never be the easiest thing on your network to reach. Whatever brand you run, this is a good week to confirm that every firewall, switch and wireless controller you own only accepts admin connections from inside, that admin accounts use multifactor sign-in, and that someone owns the job of tracking and applying appliance hotfixes as they appear.
Need help checking your firewall management exposure and scheduling appliance hotfixes without downtime? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
