PALO Alto Networks has confirmed two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, affect PAN-OS, Panorama and WildFire WF-500 appliances. The issues sit in PHP’s error handling and enable remote code execution (RCE) via out-of-memory and stale global state conditions. Palo Alto’s advisory notes that the flaws are reachable only through the management interface (web UI and XML API) and that the GlobalProtect portal and gateway are not affected.
While exploitation has not been observed in their products, the firm assigns a high risk, with CVSSv4 scores of 9.2 for both flaws and a substantial impact when the management interface is exposed to the internet. Patches are available, with fixed versions listed as PAN-OS 8.2.35, 8.3.36, 8.4.27 and 8.5.12, alongside corresponding updates for affected releases of PAN-OS and Panorama.
The affected products include PAN-OS releases 12.2, 12.1, 11.2, 11.1 and 10.2, plus Panorama and WildFire Appliance WF-500 and WF-500-B. Cloud NGFW, Prisma Access, GlobalProtect App, Cortex products and WildFire Cloud are not affected. Palo Alto has issued hotfixes targeting specific branches (for example 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4 and 10.2.18-h13).
In the meantime, organisations are advised to restrict the management interface to trusted internal IPs or jump hosts, remove management profiles from internet-facing dataplane interfaces, and enable Threat IDs 543004, 97622, 97623, 97624 and 97625 (content version 9162 or later). The advisory emphasises that protections via dataplane traffic inspection do not cover directly exposed out-of-band management ports, so limiting access remains the primary defence until patches are deployed.