Palo Alto Networks has validated two serious remote code execution (RCE) vulnerabilities impacting PAN-OS and certain network products. Identified as CVE-2026-109618 and CVE-2026-109619, these flaws stem from unsafe PHP error handling and memory misuse. The company has released hotfix schedules and interim mitigation guidance for affected systems.
What the Flaws Do
The first flaw, CVE-2026-109618, is triggered when PHP runs out of memory during request handling. In that state, request memory may remain uninitialized. As the system cleans up, it could access that improper memory region and lead to arbitrary code execution. The second, CVE-2026-109619, involves stale or global memory pointers that still reference freed memory. These lingering references can be manipulated during subsequent requests to execute malicious code.
The base PHP vulnerability set—known in broader disclosures as PHP2Shell—received a high severity rating: 9.2 on the CVSS 4.0 scale. Palo Alto’s internal risk rating across its product suite registers at 8.7. The primary concern is system availability rather than confirmed data theft or unauthorized changes.
Affected Products & Mitigations
Systems running PAN-OS in branches 10.2, 11.1, 11.2, 12.1, and 12.2 are at risk. This includes PA-Series and VM-Series firewalls, Panorama (both virtual and M-Series), via their management web interface (HTTPS console or XML API). The dataplane may also be vulnerable when a management profile is attached. Some functionality—such as GlobalProtect portals/gateways, Clientless VPN, and Captive Portal—is not impacted.
Cloud services Cortex XCORE SaaS and WildFire Cloud were affected earlier but have since been patched as of October 21 and 22. Other products including Cloud NGFW, Cortex XDR, Cortex XSIAM, Prisma Cloud, Prisma Access, and the GlobalProtect App are listed as currently unaffected.
Fixes, Timelines & Interim Steps
Palo Alto plans to deploy hotfixes for PAN-OS systems on these dates: October 26 for 10.2.18-h13, 11.1.16-h4, and 11.2.10-h16; October 28 for 12.2.4-h1; with additional branches up to October 30. These are estimates, not yet publicly available at time of the advisory.
Admins are urged to immediately tighten access controls. Restrict management interfaces to internal or trusted IPs, or use a jump box. Internet-facing consoles pose the highest danger. Palo Alto also recommends sending management traffic over dataplane ports, using proper certificates, decrypting HTTPS, and enabling threat prevention inspection. New signatures have been issued—specifically signature 543004—via content versions 9162, 9163, and 9164 to improve protection.
The company notes it is not aware of attacks specifically targeting its products via these vulnerabilities, though proof-of-concept exploits exist for the broader PHP flaws. Administrators should treat the access restrictions as stopgap measures until hotfixes are installed.
Analysis: The PHP2Shell bugs mark a sharp reminder that widely used scripting runtimes—especially in network device management contexts—pose massive risk when core components like error handlers are involved. That Palo Alto’s management interface, often exposed for remote administration, is directly affected ratchets up the threat. Organizations should move swiftly to patch, but also reassess how management interfaces are exposed and hardened. Watch for post-patch disclosures, as attackers often reverse engineer fixes to craft exploits. Going forward, PHP error routines and memory safety deserve renewed scrutiny across infrastructure software.
