Palo Alto Networks has confirmed active attacks against PAN-OS management interfaces exposed to the internet.
The company updated its CVE-2026-109618 advisory on Oct. 29 after initially publishing it on Oct. 21. The advisory covers CVE-2026-109618 and CVE-2026-109619, two PHP remote code execution vulnerabilities commonly called PHP2Shell, and rates the PAN-OS impact as critical with a CVSS score of 9.2 and a suggested urgency of HIGHEST.
The issue applies to PAN-OS software on PA-Series and VM-Series firewalls, as well as Panorama virtual and M-Series appliances. Palo Alto’s advisory says no special configuration is required for affected PAN-OS products to be vulnerable, but the highest risk is tied to allowing external internet access to the management interface.
According to the company’s FAQ, the affected surface is the management web interface, including the HTTPS web UI and XML API. Palo Alto says GlobalProtect portal, gateway and Clientless VPN are not impacted, and Captive Portal is not impacted. A dataplane interface is affected only if a management profile is attached to it.
A VPN-focused review alone may miss the risky surface if administration is internet-reachable. Palo Alto says risk can be reduced by restricting access to a jump box that is the only system allowed to reach the management interface.
Researchers reported a chained attack that reached Active Directory
Unit 42 said Dream Research reported a campaign that chained PHP2Shell with a Linux kernel privilege-escalation flaw to gain root access against PAN-OS management interfaces exposed to the internet. Unit 42 said it independently verified the attacker’s tooling and confirmed the reported results.
Dream Research reported that attackers rooted 25 PAN-OS firewall and management servers across the United States, Japan, Taiwan and South Korea. The firm said recovered artifacts showed credential extraction and directory enumeration after attackers focused on a U.S. government-affiliated environment. Dream also said it could not determine whether password spraying, backdoor account creation or SAML key extraction succeeded.
The reported chain shows why this is not only a perimeter device problem. In Dream’s account, root access to a firewall exposed internal topology and LDAP-related data that helped the attacker move toward identity systems.
Patches and mitigations are available
Palo Alto’s advisory lists fixed PAN-OS releases for supported 10.2, 11.1, 11.2, 12.1 and 12.2 branches. Unit 42 said customers that applied available patches are not affected by the observed exploit chain because the fixes interrupt it.
The company also said customers with Advanced Threat Prevention Plus on PAN-OS 12.2.4 and later received Frontier Virtual Patching coverage through Threat ID 543004 on Oct. 20. Threat Prevention customers have coverage through specified Threat IDs from Applications and Threats content versions 9162, 9163, 9164 and later, although Palo Alto’s advisory lists traffic routing, certificate, decryption and threat prevention requirements for that protection to inspect management traffic.
Palo Alto said approximately 0.02% of its global installed base had internet-facing management interfaces configured and were impacted. The company said those customers were contacted individually.
Why this is different from routine patching
The PHP Security Team issued fixes for the two underlying PHP vulnerabilities on Oct. 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on Oct. 26, and the Canadian Centre for Cyber Security said in its Oct. 27 update that open-source reporting indicated exploitation in the wild.
For Palo Alto appliances, generic PHP upgrades are not the remediation path. Administrators need to follow Palo Alto’s PAN-OS and Panorama hotfix guidance because PHP is bundled inside the appliance software.
Checks for exposed environments
The most urgent checks are whether the management web interface or XML API can be reached from public IP space, whether any dataplane interface has a management profile attached, and whether the running PAN-OS or Panorama build matches a fixed release listed in Palo Alto’s advisory.
Remove public internet access to management interfaces and restrict access to trusted internal addresses or a controlled jump host.
Upgrade affected PAN-OS and Panorama builds to fixed versions listed by Palo Alto.
Review firewall, web-management, authentication, endpoint and outbound connection logs for unusual activity if management access was exposed before patching.
Check for unexpected accounts, files, processes, tunnels and configuration changes, especially where LDAP or SSO integrations are present.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
