Essential Insights
-
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, can enable remote code execution through unsafe memory handling; Palo Alto rates their product impact high (8.7).
-
PAN-OS and Panorama are affected across versions 10.2, 11.1, 11.2, 12.1 and 12.2. Exposure is limited to management interfaces, including HTTPS administration and XML API; certain cloud services have already been patched.
-
No malicious exploitation of Palo Alto products is known, though Unit 42 has observed proof-of-concept exploits for the broader PHP vulnerabilities. PAN-OS hotfixes were scheduled for October 26–30, 2026, with dates subject to change.
- Restrict management access now to trusted internal IPs or a dedicated jump box, especially for internet-facing interfaces. Treat this as temporary protection and install the applicable hotfix when available.
The Issue
Palo Alto Networks confirmed that two critical PHP remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, affect several PAN-OS versions and previously affected its Cortex XCORE SaaS and WildFire Cloud services. The flaws arise when PHP handles serious errors: one can leave request memory improperly initialized after an out-of-memory condition, while the other can retain references to memory that has already been freed. Attackers may exploit these unsafe states to run code remotely. Palo Alto said it had no evidence of attacks against its products, although its Unit 42 team observed proof-of-concept code targeting the broader PHP vulnerabilities.
The affected systems include PA-Series and VM-Series firewalls, as well as Panorama deployments, when their management web interfaces are exposed; a dataplane interface is at risk only if it has a management profile. Palo Alto patched the two cloud services on October 21 and 22, but PAN-OS fixes were still pending on October 24, 2026. Until those updates arrive, the company advises administrators to restrict management access to trusted networks or a dedicated jump box, especially for internet-facing interfaces. This account was reported by Cyber Security News, which cited Palo Alto Networks’ advisory and Unit 42’s findings.
What’s at Stake?
This issue can affect any business that operates a vulnerable, exposed Palo Alto product, including certain PAN-OS environments. A PHP remote-code-execution flaw may let an attacker run commands on an affected device. If exploited, that foothold could disrupt network access, expose sensitive information, or help an intruder move deeper into the organization. Consequently, a company might face outages, incident-response costs, regulatory scrutiny, and lost customer trust. The actual risk depends on the product, software version, configuration, and exposure; businesses should verify whether their devices are affected and apply Palo Alto’s recommended fixes or mitigations promptly.
Possible Next Steps
Timely remediation limits attackers’ opportunity to exploit exposed systems and supports the NIST CSF’s risk-reduction objectives.
Mitigation Steps
- Identify: Inventory PAN-OS and other Palo Alto Networks products; compare their exact versions with the vendor’s advisory to confirm exposure.
- Protect: Install Palo Alto Networks’ recommended fixed releases promptly. If patching must wait, apply only the vendor’s stated workarounds.
- Restrict administrative interfaces to trusted networks, use secure remote access and multifactor authentication, and block unnecessary access to affected services.
- Avoid disabling PHP components or changing appliance settings unless Palo Alto Networks specifically recommends it.
- Detect: Review appliance and network logs for unusual requests, activity, or outbound connections; investigate any indicators identified in the advisory.
- Respond and recover: If compromise is suspected, preserve relevant logs, follow incident-response procedures, rotate potentially exposed credentials, and restore systems from trusted configurations.
- Verify the fix by checking installed versions and confirming that temporary safeguards can be safely removed.
Continue Your Cyber Journey
Explore career growth and education via Careers & Learning, or dive into Compliance essentials.
Access world-class cyber research and guidance from IEEE.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
