Palo Alto Networks Reports PHP Attacks on Firewall Management

Attackers are hitting internet-exposed Palo Alto Networks firewall management interfaces through two PHP remote-code-execution flaws, according to the company’s October 27 advisory. Operators of PA-Series and VM-Series firewalls and Panorama need to check both the management path and the installed PAN-OS maintenance build. The advisory rates the issue critical and says, “Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.”

This is the management HTTPS web UI and XML API, including a dataplane interface with a management profile attached. It is the place administrators configure the firewall, so code execution there threatens the appliance itself. Palo Alto Networks identifies affected builds in the supported 12.2, 12.1, 11.2, 11.1 and 10.2 lines. GlobalProtect portal, gateway and Clientless VPN are unaffected by these PHP flaws; a VPN exposure inventory alone will miss the management interface.

PHP errors reach firewall management

The PHP CVE record for CVE-2026-109618 describes an out-of-memory error path: PHP uses longjmp() to abandon a request, leaving request memory uninitialized before later cleanup reads or branches on it. The record for CVE-2026-109619 describes global state that still points into freed request memory and can be read by a subsequent request. Both can lead to remote code execution. Use the PAN-OS advisory to determine which appliance builds and management interfaces are affected; upstream PHP version numbers do not identify a fixed PAN-OS build.

The vendor says no special configuration is needed for an affected build. Network access determines who can reach the vulnerable service: the risk is highest when management accepts internet clients. A dataplane port carrying ordinary traffic is relevant to this advisory when its management profile exposes the web UI or XML API.

Unit 42’s threat brief originally connected a European government intrusion to PHP2Shell, then retracted that attribution on October 25 because it could not confirm the initial-access CVE. The product advisory separately reports attacks against internet-exposed Palo Alto Networks management interfaces. Unit 42 counts over 22.6 million potentially vulnerable exposed PHP instances across its wider telemetry; scope the firewall response with PAN-OS inventory and management reachability.

Find reachable interfaces and vulnerable builds

Start with management routing and access policy for PA-Series, VM-Series and Panorama. Identify every dedicated MGT port and every dataplane interface with a management profile. From an untrusted network, test whether the HTTPS web UI or XML API responds; repeat from the approved jump box. Restrict management to trusted internal IP addresses or one jump box, the vendor’s recommended interim control. After changing policy, the untrusted path should fail and the approved administrative path should still work. Check the firewall’s management exposure again after any interface or management-profile change.

Match the installed PAN-OS build to the specific maintenance branch in the vendor’s solution table, then schedule the applicable fixed hotfix. For example, 12.2.4-h1, 12.1.7-h11, 12.1.10-h3, 11.2.10-h16, 11.1.16-h4 and 10.2.18-h13 are fixed thresholds for their respective maintenance branches. Those examples are not interchangeable across branches: 12.1.4 needs 12.1.4-h13 or the listed later branch, while 10.2.7 needs 10.2.7-h39 or the listed later branch. The October 27 advisory still labels several hotfixes with future release estimates. Confirm a build is actually available before scheduling its upgrade. Older unsupported PAN-OS versions need a supported fixed version.

Teams also fixing the PAN-OS Brotli flaw need to check a second target: the vendor says 11.2.10-h16 fixes these PHP flaws but only the PHP flaws; 11.2.10-h17 contains both the PHP and Brotli fixes.

Check protection on the real path

Palo Alto Networks lists Frontier Virtual Patching coverage through Threat ID 543004 for customers with ATP Plus on 12.2.4 and later. Its broader Threat Prevention protection requires a more particular topology: management traffic must enter through a dataplane port, the inbound management certificate must be replaced, the traffic must be decrypted for inspection, and Threat Prevention must be enabled on that inbound flow with the applicable Applications and Threats content. On a firewall whose management traffic bypasses the dataplane, Threat Prevention cannot inspect those management requests. Prefer access restrictions and the fixed build as the primary response.

For firewalls with past internet-reachable management access, preserve management access and threat logs and investigate suspicious management requests or unexpected administrative changes during the exposed period. A current blocked-reachability test and a fixed build tell you the present access and patch state; investigate historical activity separately where exposure existed. Unit 42’s published XDR hunt is aimed at PHP worker child processes on general web servers and is not a PAN-OS management-compromise test.

Keep management on the approved route

Remove internet reachability to the management web UI and XML API on the dedicated MGT port and any dataplane management profile. Record the running PAN-OS software build and compare it with the vendor’s maintenance-branch fix table; for example, 12.2.4 requires 12.2.4-h1 or later. For teams also fixing the Brotli flaw, 11.2.10-h16 fixes PHP alone and 11.2.10-h17 covers both. Test HTTPS management from an untrusted network and from the designated jump box: the untrusted connection should fail and the jump box should connect. Where the interface was exposed before the change, review retained management activity as an incident question, even if today’s path is restricted.