PHP2Shell Flaws Impact Palo Alto PAN-OS as Cisco and Fortinet Assess Exposure

A pair of critical PHP vulnerabilities known collectively as the PHP2Shell vulnerability has triggered emergency investigations across major network infrastructure vendors, with Palo Alto Networks confirming that all versions of PAN-OS and Panorama management software are affected. Tracked in vendor advisories under CVE-2026-109618, the flaws allow unauthenticated attackers to execute arbitrary code on vulnerable web servers. While Palo Alto prepares fixed software builds, enterprise networking peers Fortinet and Cisco are actively evaluating dozens of firewalls, network management consoles, and cloud security services to determine their exposure.

PAN-OS and Panorama Face High Exposure on Public Interfaces

Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are vulnerable to PHP2Shell in default configurations without requiring special settings. The vendor rates the issue as high severity (CVSS-B 8.7) with moderate urgency, scoring the flaw’s primary impact against its own products as a service outage (availability) rather than immediate data theft or tampering. However, the operational risk is extreme if an organization’s PAN-OS management interface accepts connections from the public internet. Restricting management access to a secure, dedicated jump box lowers Palo Alto’s calculated score to 7.1.

Palo Alto has not yet released patched PAN-OS or Panorama software versions, stating that release estimates and version numbers will be added to its advisory once available. In the meantime, the vendor recommends strict network isolation and signature-based virtual patching. Customers using Frontier Virtual Patching received coverage under Threat ID 543004 on October 20, prior to the official PHP project patch release, while Advanced Threat Prevention pushed standard IPS signatures (543004, 97622, 97623, 97624, and 97625) on October 21. Seven Palo Alto offerings—Bridgecrew, Cloud NGFW, Cortex XDR Agent, Cortex XSOAR, Cortex Xpanse, Idira, and Prisma Access—have been confirmed unaffected.

Fortinet Clears FortiOS; Cisco Audits 31 Enterprise Products

Fortinet and Cisco published initial advisories following the leak of the PHP2Shell flaw details ahead of scheduled disclosures. Fortinet’s PSIRT advisory rates CVE-2026-109618 as critical with a CVSS v3 score of 9.8, while FortiGuard Labs rates both CVEs at 9.2 under CVSS 4.0, noting no confirmed active exploitation against Fortinet products.

Crucially for edge defense, Fortinet confirmed that FortiOS—the operating system running FortiGate firewalls—is cleared and not impacted. FortiManager, FortiAnalyzer, FortiWeb, FortiMail, FortiSASE, FortiAuthenticator, FortiSwitch, FortiNAC, and FortiClient for desktop operating systems were also confirmed safe. However, 12 Fortinet products remain under review, including FortiADC, FortiADC Manager, FortiClient EMS, FortiDDoS, FortiDDoS-F, FortiSIEM, FortiMonitor, FortiClient Cloud, FortiSOAR, FortiSOAR PaaS, FortiGuard, and FortiEndpoint. FortiGuard Labs released virtual patches in package version 37.316 to mitigate general PHP exposures.

Cisco’s PSIRT advisory rates the vulnerabilities as critical but currently lists zero products as confirmed vulnerable and zero products as cleared. Cisco is actively auditing 31 products and cloud services spanning network security, wireless, routing, and SaaS platforms. Key platforms under review include:

• Network & Security: Cisco Identity Services Engine (ISE), Cisco Hypershield, and Cisco AI Defense (hybrid on-premises).
• Management Platforms: Catalyst Center (formerly DNA Center), Catalyst SD-WAN Manager, Nexus Dashboard Insights, Business Process Automation (BPA), and WAN Automation Engine (WAE).
• Cloud & App Services: Cisco Umbrella, Secure Access, Defense Orchestrator, AppDynamics SaaS and On-Premises Secure Application, Webex, and Slido.

Cisco confirmed that no workarounds currently exist for unpatched products. As the investigation identifies affected platforms, Cisco will track them via bug entries in its Bug Search Tool, which will provide workarounds and fixed software release timelines.

Vulnerability Mechanics and Exploit State

The PHP2Shell vulnerability class involves severe memory safety or input handling flaws within the core PHP engine, allowing unauthenticated attackers to pass maliciously crafted web requests to an underlying PHP runtime and trigger remote code execution (RCE). Because enterprise management consoles and web appliances frequently rely on embedded PHP web servers for administrative user interfaces, an unauthenticated flaw in the core language runtime creates a massive blast radius across network perimeters and management networks.

Security researchers at VulnCheck successfully reproduced both PHP2Shell flaws following the detail leak on October 20. VulnCheck’s analysis indicates that functional RCE is currently achievable on ARM64 architectures and x86 environments where Address Space Layout Randomization (ASLR) is disabled. On ARM64 systems, ASLR memory offsets can be brute-forced relatively easily. However, on modern 64-bit x86 systems with ASLR enabled, none of the dozens of public proof-of-concept (PoC) repositories currently circulating on GitHub successfully bypass memory randomization on their own.

Despite the current lack of reliable x86-64 exploit chains, security teams should expect widespread automated scanning and opportunistic exploit attempts. Botnets and threat actors frequently weaponize public PoC scripts into automated spray campaigns regardless of whether the target platform is vulnerable or running an exploit-compatible architecture.

Mitigation and Defense Recommendations

To reduce exposure to PHP2Shell while vendor patches remain pending:

• Isolate Appliance Management Interfaces: Disconnect all PAN-OS, Panorama, Fortinet, and Cisco administrative interfaces from the public internet immediately. Enforce access strictly through internal management subnets or secure jump boxes.
• Update Standalone PHP Runtimes: For organizations maintaining custom PHP web applications or Linux servers, upgrade standalone PHP packages to fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. For legacy systems running end-of-life PHP 8.1 or older, apply backported vendor packages from OS maintainers (such as Ubuntu, Debian, or Alpine Linux 3.24) or migrate to a supported release branch.
• Apply IPS and Virtual Patching Signatures: Ensure intrusion prevention systems are updated to include Palo Alto Threat IDs 543004 and 97622–97625, or FortiGuard virtual patch package 37.316.
• Restrict Web Server Inputs: Implement reverse proxy or web server controls to limit HTTP request sizes, input fields, header lengths, multipart sections, and nesting depth to restrict payload delivery.
• Monitor Administrative Logs: Audit web server logs and host process trees for abnormal PHP worker activity, unexplained process execution, or unusual access to application configuration files and databases.