Palo Alto Networks Reports PHP Attacks on Firewall Management

Palo Alto Networks reports active attacks on internet-exposed management interfaces of affected PA-Series and VM-Series firewalls and Panorama. The flaws, CVE-2026-109618 and CVE-2026-109619, can lead to remote code execution in PHP error-handling paths. The affected management surface is the HTTPS web UI and XML API, including a dataplane interface with a management profile; GlobalProtect portal and gateway are unaffected by these PHP flaws.

Identify both the dedicated MGT interface and dataplane management profiles, then restrict access to trusted internal addresses or a single administrative jump box. Compare the installed PAN-OS maintenance build with the vendor’s branch-specific fix table. Some hotfixes still carried future estimates in the October 27 advisory. If your change window also addresses the Brotli flaw, 11.2.10-h16 fixes PHP only; 11.2.10-h17 covers both.

Test HTTPS management from an untrusted network and the approved jump box after restricting access: only the approved path should connect. Threat Prevention signatures require management traffic routed through a dataplane port, inbound decryption, the replaced management certificate and enabled inspection. For formerly internet-reachable interfaces, preserve and examine retained management activity for suspicious requests or changes. Unit 42 retracted its earlier attribution of a European government intrusion to these PHP CVEs; the product advisory independently reports management-interface exploitation.