Palo Alto says PHP2Shell flaw CVE-2026-109618 is now exploited against exposed PAN-OS management interfaces

Three statements in eight days, and none of them in the advisory's own log

Palo Alto Networks now says its firewalls are being attacked through PHP2Shell. Read from its advisory at 11:20 UTC on Thursday 29 October 2026, the exploitation status says: "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet." The same page said something different twice before. An Internet Archive capture from 22 October and another from 23 October at 16:40 UTC read "not aware of any malicious exploitation". A capture from 27 October at 17:10 UTC reads "Very limited exploitation has been observed". The current wording is in a capture from 07:45 UTC on 29 October. The advisory's revision history has 15 entries. None of them mentions exploitation (counted by this site in the page and in the CSAF file). The move from not aware to active is visible only by comparing copies of the page.

The timing, derived from those captures: PHP published its fixes on 21 October and the CVE records went up at 13:48 UTC that day. The first exploitation wording appeared somewhere between 51 and 147 hours later, and the active wording somewhere between 147 and 186 hours later (derived). The advisory does not say on which day either change was made, so the captures are the only record of when, and they give a window, not a moment.

What this does not establish: how many devices were attacked, whether any attack succeeded, who is behind it, which PAN-OS versions were hit, or when Palo Alto first saw it. The advisory says "targeting", a word that covers attempts as well as compromises. It prints no indicators. Palo Alto sells the firewalls concerned and the Threat Prevention subscriptions its advisory offers as an interim mitigation, which is a commercial interest in how this advice is framed.

The flaws themselves, the emergency releases, the decoy server results and the federal catalogue listing are covered elsewhere on this site: the fixes, the decoy shells, the CISA listing and a report of firewalls from an unnamed vendor rooted with the same flaws. This briefing is only what Palo Alto's own record adds.

Zoom

The first score said denial of service; the rescore said code execution

The exploitation line was not the only thing that moved. On 22 October Palo Alto scored the issue in PAN-OS at 8.7, HIGH, with urgency MODERATE, and the vector set confidentiality and integrity impact to none and availability to high. In plain terms, Palo Alto's first assessment of its own product described an attacker who could knock the management interface over, not one who could run code on it. The PHP project's record, scored 9.2, described remote code execution from the start.

Revision 13 changed that. The CSAF file timestamps it 27 October 09:40 with a Z suffix, but its revision 1 sits seven hours before the file's own initial release time of 16:00 UTC, and the RSS feed dates revision 15 to 05:20 UTC, so this site reads them as Pacific time: 16:40 UTC (derived). The entry says only: "Severity Updated to Critical and Urgency updated as Highest". The new vector sets confidentiality, integrity and availability all to high, raises attack complexity from low to high, and the capture 30 minutes later already carries the very limited exploitation line. Whether the rescore and the first sighting were linked, the advisory does not say.

What Palo Alto says is exposed, and what it says is not

The advisory is specific about the surface. Its FAQ says the issue "strictly affects the management web interface, which includes the HTTPS web UI and XML API service", and that a dataplane interface is affected only if a management profile is attached to it. It applies to PAN-OS on PA-Series and VM-Series firewalls and on Panorama, virtual and M-Series. GlobalProtect portal, gateway and Clientless VPN are not impacted, nor is the captive portal. Cloud NGFW, Prisma Access and the other cloud products in its table are listed as not affected; two services, Cortex XCORE and WildFire Cloud, were affected and patched on 21 and 22 October.

That narrows the question for an owner to one thing: does the management web server answer from anywhere it should not? The advisory's own risk sentence says the risk is highest when management access is allowed "from external IP addresses on the internet". Its configuration section says "No special configuration is required to be affected", so a default build is vulnerable; exposure is what turns vulnerable into reachable.

Zoom

Where a label does the work of a control

"Customers with a Threat Prevention subscription are provided with coverage" reads like a control. The next sentence makes it conditional: for the 25 threat IDs to protect, management traffic must be routed through a dataplane port, the inbound management certificate replaced, the traffic decrypted and threat prevention enabled on it. Palo Alto's own administrative access guide explains why: "You cannot apply Security policy rules directly to traffic that ingresses the dedicated MGT port." A firewall whose web interface sits on the MGT port, with the signatures switched on and nothing else changed, has the subscription and not the coverage. That is this site's reading of the two Palo Alto texts together.

Two more labels deserve a second look. "Exploit Maturity: ATTACKED" and "targeting" tell a reader that attacks exist, not that any device fell, and the advisory gives no way to tell which. And "Discovered: internally" sits on an advisory about a flaw the PHP project disclosed; the page does not explain what Palo Alto discovered. PHP's own notice says Linux distributions and LTS vendors received the patches in advance, and Palo Alto says its first signature shipped at 10:21 PM Pacific on 20 October, before the public records; whether Palo Alto was among those told early is not stated.

Zoom

The fixes arrived over five days, and one is still due

The advisory lists 20 fixed hotfix versions across five supported branches. By its own log, the first three were released by 05:25 UTC on 25 October, 87.6 hours after the CVE records, and the last five by 05:20 UTC on 29 October, 183.5 hours after (both derived, and both the time the page was updated, which can trail the release). One is still marked with an estimate: 11.1.7-h12, "ETA: 10/30". The advisory gives 11.1.16-h4 as the alternative for that line. Its Solution section still opens: "This issue will be fixed in the upcoming releases of PAN-OS." That sentence is now out of date for every branch except one hotfix line.

For United States federal agencies, CISA's catalogue (version 2026.10.28) lists both flaws under PHP Group with a due date of 29 October, today. The entries point to php.net and do not mention PAN-OS. The one pending hotfix is due a day after that deadline (derived), though the alternative line already exists. Older, unsupported PAN-OS versions get one instruction: upgrade to a supported fixed version.

Stated and not stated

Two cautions on numbers that travel with this story. Unit 42, Palo Alto's research unit, says Cortex Xpanse saw over 22.6 million exposed instances potentially vulnerable; that is PHP across the internet, not PAN-OS devices. And Unit 42 retracted, on 25 October, an earlier update that tied an attack on a European government agency to these flaws. Its brief, which the advisory links for more details, says nothing about PAN-OS exploitation and still lists only five threat IDs.

Technical details

Everything below is copied from the saved pages, with whitespace tidied. Nothing here is exploit code, and the advisory prints no indicators of compromise, hashes, addresses or log lines, so there are none to give. Each block says what it is for.

First, the exploitation status line as it read in three copies of the advisory. Diff your own saved copy against these; the revision log will not tell you.

22 Oct 2026 capture:
Palo Alto Networks is not aware of any malicious exploitation of this issue against our products.

27 Oct 2026 17:10 UTC capture:
Very limited exploitation has been observed targeting the Palo Alto Networks management interface.

29 Oct 2026 live page:
Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.

Second, the CVSS 4.0 vectors Palo Alto gave its own product, first and now. The first has VC:N and VI:N, availability only; the second has full impact and E:A, attacked. The third is the score Palo Alto gives when only a jump box can reach the interface.

22 Oct 2026, internet exposed:
CVSS-B: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber)

29 Oct 2026, internet exposed:
CVSS-BT: 9.2 /CVSS-B: 9.2 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red)

29 Oct 2026, jump box only:
CVSS-BT: 5.2 /CVSS-B: 7.7 (CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber)

Third, the workarounds and mitigations section, exactly as printed. The four lines after the colon are the conditions for the threat IDs to protect. If you use the signatures as an interim measure, check each one on each device.

Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 and later versions received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20.
Customers with a Threat Prevention subscription are provided with coverage against this vulnerability by enabling Threat ID 543004, 97622, 97623, 97624, 97625, 97643, 97647, 97649, 97652, 97653, 97656, 97657, 97658, 97659, 97662, 97663, 97664, 97670, 97671, 97672, 97673, 97674, 97676, 97677, 97678 (from Applications and Threats content version 9162, 9163, 9164 and later). For these Threat IDs to protect against attacks for this vulnerability:
Route incoming traffic for the MGT port through a DP port, e.g., enabling management profile on a DP interface for management access.
Replace the Certificate for Inbound Traffic Management.
Decrypt inbound traffic to the management interface so the firewall can inspect it.
Enable threat prevention on the inbound traffic to management services.
The security risk posed by this issue on PAN-OS and Panorama is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.

Fourth, the FAQ answers that define the attack surface. Use them to scope the exposure check: the HTTPS web UI and the XML API, plus any dataplane interface with a management profile.

Which part of the PAN-OS® product is affected?
This issue strictly affects the management web interface, which includes the HTTPS web UI and XML API service.
Does it affect any standard dataplane interface, or specifically ones with a management profile attached?
It affects the dataplane interface only if a management profile is attached to it.
Is GlobalProtect™ impacted?
GlobalProtect portal, gateway and Clientless VPN are not impacted.
Is Captive Portal impacted?
The captive portal is not impacted.

Note: This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

Fifth, the fixed versions, one branch per line, copied from the Product Status table's unaffected column. A device is fixed at or above the hotfix for its own line; the Solution table maps each minor line to its hotfix.

PAN-OS 12.2: >= 12.2.4-h1
PAN-OS 12.1: >= 12.1.4-h13, >= 12.1.7-h11, >= 12.1.10-h3
PAN-OS 11.2: >= 11.2.4-h23, >= 11.2.7-h23, >= 11.2.10-h16, >= 11.2.13-h4, >= 11.2.16-h1
PAN-OS 11.1: >= 11.1.4-h38, >= 11.1.6-h40, >= 11.1.7-h12, >= 11.1.10-h36, >= 11.1.13-h16, >= 11.1.16-h4
PAN-OS 10.2: >= 10.2.7-h39, >= 10.2.10-h42, >= 10.2.13-h27, >= 10.2.16-h12, >= 10.2.18-h13

>= 11.1.7-h12 (ETA: 10/30)

Sixth, a caution for anyone feeding a scanner from the machine readable copy. The CSAF file's known affected entries are five ranges, one per branch, each ending at the lowest hotfix in that branch. Read literally, a range such as PAN-OS below 11.1.4-h38 would not cover 11.1.10-h5, which the page lists as affected below 11.1.10-h36. That is this site's reading; use the page table, not the ranges, until the file is corrected.

vers:generic/PAN-OS<10.2.7-h39
vers:generic/PAN-OS<11.1.4-h38
vers:generic/PAN-OS<11.2.4-h23
vers:generic/PAN-OS<12.1.4-h13
vers:generic/PAN-OS<12.2.4-h1

"number": "13", "date": "2026-10-27T09:40:00.000Z", "summary": "Severity Updated to Critical and Urgency updated as Highest"

Seventh, the two sentences from Palo Alto's administrative access guide that matter most here. The first is why the signatures need the routing change; the second is the guide's own rule.

You cannot apply Security policy rules directly to traffic that ingresses the dedicated MGT port.
never expose the management interface directly to the internet.

A ranked checklist for PAN-OS and Panorama owners

Exposure comes first because it is the one step that needs neither a hotfix nor a subscription, and it is the condition Palo Alto names in its exploitation line.

The question that exposes the gap

Palo Alto went from not aware, to very limited, to active exploitation in eight days, and rescored its own product from a denial of service to code execution on the way. Each change was in the page; none was in the log a patch team would read. So the question for every firewall owner is not whether you read the advisory. It is this: when your vendor's exploitation status changes without a revision entry, what in your process notices, and which of your management interfaces could still be reached from the internet on the day it did?

Key facts