PHP2Shell on PAN-OS: the firewall's management interface becomes the way in

A firewall is not just a filtering engine. Its management plane is a small web server: the HTTPS console you open in a browser, and the XML API that automation tools use. On PAN-OS, that server relies on PHP.

Palo Alto puts it plainly: the flaw strictly affects the management web interface, HTTPS console and XML API. A data interface is in scope only if a management profile is attached to it. No special configuration is needed to be affected.

So the risk turns on a network question, not a PHP one: who can reach the management interface?

CVE-2026-109618 and CVE-2026-109619, rated 9.2, critical, under CVSS 4.0. The PHP project fixed them on 21 October 2026 (PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12). Both allow code execution without logging in.

At Palo Alto Networks, PAN-OS on PA-Series and VM-Series firewalls is affected, and so is Panorama. Not affected, per the advisory: Prisma Access, Cloud NGFW, Strata Cloud Manager, and the GlobalProtect portal and gateway and Captive Portal.

As of 29 October, the advisory lists fixes as released for every tracked branch: 10.2, 11.1, 11.2, 12.1 and 12.2. Older, unsupported releases must move to a fixed release.

Unit 42, Palo Alto's research team, reports a campaign that chained PHP2Shell with a Linux kernel privilege escalation, CVE-2026-46300, to get root on exposed PAN-OS management interfaces. Unit 42 independently checked the tooling and the results. CISA added CVE-2026-46300 to its catalog of exploited vulnerabilities on 28 October.

Palo Alto says a very small share of its installed base, a few hundredths of a percent, had a management interface reachable from the Internet, and that those customers were contacted one by one. Patched customers, and those that do not expose the interface, are not affected according to the vendor.

Many network devices embed PHP in their console. Cisco lists affected products, among them Expressway and Duo Access Gateway, with no known exploitation against its products. Fortinet confirmed FortiOS is not affected and is reviewing FortiDDoS and FortiSOAR. The right reflex applies to all of them: know which management consoles exist on the network, and where they can be reached from.

In the order Palo Alto gives: remove any Internet access to the management interface, restrict it to trusted internal addresses or a jump host, then apply the fixed hotfix for your branch.

Until the fix is in, the advisory lists measures: route management access through a data interface so the firewall inspects it, with Threat Prevention and the published signatures (including threat ID 543004).

NacTrack reads each PAN-OS firewall's exported configuration: the model, the release and the hotfix level, to compare with the advisory's table. Its compliance rule NTC-PAN-1.2 flags a firewall whose management access is not restricted by a permitted address list, and other rules flag plain HTTP and Telnet on the management interface.

NacTrack detects and reports. It fixes nothing, blocks nothing, and does not replace a test from the Internet: a permitted list in the configuration does not tell you what an attacker sees from outside. For PAN-OS, reading is done from the exported configuration, with no automatic collection.

Sources: Palo Alto Networks advisory CVE-2026-109618, Unit 42, CISA alert of 28 October 2026, Cisco advisory, Fortinet advisory FG-IR-26-186, and the The Hacker News article.

Defensive education: the attack is described in principle only, with no exploitation steps, tools or payloads. Check your platform and release in the vendor's advisory, which is authoritative.