PHP2Shell Across Palo Alto Products: Status and Hotfix Dates

Palo Alto Networks lists PAN-OS and Panorama as affected by the PHP2Shell flaws, through the management web interface. Most of its other products are not affected. The hotfixes are not out yet. Palo Alto gives estimated dates from 26 to 30 October 2026, depending on the release train.

Palo Alto says it is not aware of malicious exploitation of this issue against its products. The table below sets each product side by side, taken from its advisory, last updated on 23 October at 17:10 UTC. The two PHP flaws are explained in our PHP2Shell analysis.

Palo Alto Product Matrix

Read the table by row. PAN-OS and Panorama need action. Every other row is either clear or already fixed by Palo Alto. The notes below explain each group.

PAN-OS and Panorama: Reading the Score

The advisory says the issue “strictly affects the management web interface”. That covers the HTTPS web UI and the XML API service. No special configuration is needed to be affected. A data plane interface is affected if a management profile is attached to it.

Palo Alto gives the issue a CVSS v4.0 score of 8.7 (High) for its products. The vector shows high impact on availability and none on confidentiality or integrity. The advisory says the risk is highest when the interface accepts connections from the internet.

A second score of 7.1 (High) applies when a jump box alone can reach the management interface. The attack vector there is adjacent, not network.

PHP and Unit 42 rate the PHP flaws themselves 9.2. Palo Alto’s advisory text describes both as remote code execution flaws in PHP. For PAN-OS, read the risk from Palo Alto’s own product score, not from the 9.2 given to PHP.

Hotfix Calendar by Release Train

Palo Alto added estimated availability dates on 23 October. They are estimates and can move. The advisory lists PAN-OS and Panorama in one row with one set of hotfixes. A build below the hotfix of its own base release is affected.

Products Palo Alto Lists as Not Affected

Palo Alto also lists Prisma Cloud, GlobalProtect App, the Cortex XDR Agent, XSIAM, XSOAR and Xpanse, Strata Cloud Manager and the Prisma SD-WAN products as not affected. Its FAQ adds that GlobalProtect portal, gateway and Clientless VPN are not impacted, and neither is the Captive Portal.

WildFire and Cloud Rows Explained

The WildFire appliances WF-500 and WF-500-B show “None” in the affected column today. Palo Alto’s timeline says that on 23 October at 17:10 UTC it corrected their impact status. If a summary or a social post still lists WF-500 as affected, compare it with the advisory.

Palo Alto says two cloud services were affected earlier: Cortex XCORE (SaaS), patched on 21 October, and WildFire Cloud, patched on 22 October. Customers do not install anything for these.

Bridging the Gap Until Your Hotfix Date

These steps come from the workarounds section of Palo Alto’s advisory:

1. Restrict access to the management interface to trusted internal IP addresses. Palo Alto says this minimizes the risk and points to its best-practice guidance.
2. Check the permitted IP addresses on the management interface and on every interface with a management profile. In the web UI the profiles sit under Network, Network Profile, Interface Mgmt, says Palo Alto’s administrative access guide. Remove addresses you do not recognize.
3. With a Threat Prevention subscription, enable Threat IDs 543004, 97622, 97623, 97624 and 97625. They need Applications and Threats content version 9162 or later.
4. For those Threat IDs to protect the management interface, Palo Alto says to route incoming management traffic through a data plane port. It also says to replace the certificate for inbound management traffic, decrypt that traffic so the firewall can inspect it, and enable threat prevention on it.
5. Customers with Frontier Virtual Patching (Advanced Threat Prevention Plus) on PAN-OS 12.2.4 and later received advance coverage. It came through Threat ID 543004, released at 10:21 PM Pacific Time on 20 October.

Spotting an Exposed Management Interface

Start with where the interface answers. From a host outside your network, such as a cloud virtual machine, see whether the management web interface opens on its HTTPS port. Send no exploit traffic. A login page that loads is enough evidence.

Teams that lose track of their devices can use external attack surface management to list every firewall address that faces the internet.

• Write down the management IP address of every PAN-OS firewall and every Panorama server.
• Read the version of each device and compare it with the hotfix calendar.
• List the interfaces that have a management profile attached, because Palo Alto says they are affected too.

Attacks Palo Alto and Unit 42 Describe

Unit 42, Palo Alto’s research team, reports attacks on other targets. It says it has seen proof-of-concept code for the PHP flaws, and that at least one European government took its website offline as a precaution.

Unit 42 also says attackers used agentic AI attack platforms after exploitation, and that in one case in Europe they reached password hashes and multi-factor authentication secrets within two hours.

Cisco, Citrix and Fortinet Side by Side

PHP also sits inside appliances from other vendors. This table shows what each vendor’s own advisory says.

Cisco’s advisory was updated on 23 October and is still marked interim. Its PSIRT knows of no malicious use. Cisco says an attacker must be an authenticated administrator for Ultra-Reliable Wireless Backhaul.

Citrix’s advisory says its managed cloud services are already addressed. Fortinet’s advisory FG-IR-26-186 is still under investigation for the listed products.

Latvia’s national cybersecurity team, on X, named four vendors early. Our search found 81 unique public posts on X from 21 to 23 October that name PAN-OS, Palo Alto or Panorama together with PHP2Shell or its CVE ids.

“may affect other products that use PHP” (our translation), @certlv, 22 October. CERT.LV names Cisco, Fortinet, Palo Alto Networks and Citrix NetScaler among them.

Not the First PAN-OS Management Flaw

Management interfaces have been a weak spot for PAN-OS before. Our CVE-2026-0322 page covers a separate flaw. It lets an attacker who can log in and reach the interface run code as root, and CISA lists it as exploited. PHP2Shell is a different issue in PHP, so check both advisories for your devices.

Our PHP2Shell timeline follows how the first days of CVE-2026-109618 and CVE-2026-109619 unfolded. The post on the PHP session upload progress advisory covers a later PHP advisory. We will update this post when Palo Alto releases the hotfixes.