PHP2Shell Across Palo Alto Products: Status and Hotfix Dates

Palo Alto Networks lists PAN-OS and Panorama as affected by the PHP2Shell flaws, through the management web interface. Most of its other products are not affected. As of 29 October, all 20 hotfixes are out. The last one, 11.1.7-h12, was listed as released that day.

Palo Alto now reports active exploitation. Its advisory, updated on 29 October, says active exploitation has been observed targeting the management interface when it is exposed to the internet. On 27 October Palo Alto raised the severity to Critical and the urgency to Highest. The advisory gives no detail on who is behind the attacks.

On 29 October Unit 42 said it had verified the tooling of an attacker that Dream reported. Both reports are covered below.

The table below sets each product side by side, taken from the same advisory. The two PHP flaws are explained in our PHP2Shell analysis.

Palo Alto Product Matrix

Read the table by row. PAN-OS and Panorama need action. Every other row is either clear or already fixed by Palo Alto. The notes below explain each group.

PAN-OS and Panorama: Reading the Score

The advisory says the issue “strictly affects the management web interface”. That covers the HTTPS web UI and the XML API service. No special configuration is needed to be affected. A data plane interface is affected if a management profile is attached to it.

Palo Alto gives the issue a CVSS v4.0 score of 9.2 (Critical) for its products. The vector shows high impact on confidentiality, integrity and availability, and its threat metric is set to Attacked. The advisory says the risk is highest when the interface accepts connections from the internet.

A second score of 5.2 (Medium) applies when a jump box alone can reach the management interface. The attack vector there is adjacent, not network, and the base score is 7.7. Palo Alto says restricting access to such a jump box lowers the risk.

PHP and Unit 42 rate the PHP flaws themselves 9.2. Palo Alto’s advisory text describes both as remote code execution flaws in PHP. On 27 October Palo Alto raised the severity of its own product score to Critical, in line with the 9.2 given to PHP.

Hotfix Calendar by Release Train

Update 30 October 2026: Palo Alto now lists all 20 hotfixes as released. The last six shipped on 29 October: 10.2.7-h39, 10.2.10-h42, 11.1.7-h12, 11.2.4-h23, 12.1.4-h13 and 12.1.10-h3.

Palo Alto added estimated availability dates on 23 October and removed each date once the build shipped. No estimated date is left; the table follows the advisory as of 29 October. The advisory lists PAN-OS and Panorama in one row with one set of hotfixes. A build below the hotfix of its own base release is affected.

Palo Alto’s FAQ says the same hotfix covers both the PHP flaws and the Brotli flaw in Node.js. The exception is 11.2.10-h16, which carries only the PHP fix; 11.2.10-h17 has both.

Products Palo Alto Lists as Not Affected

Palo Alto also lists Prisma Cloud, GlobalProtect App, the Cortex XDR Agent, XSIAM, XSOAR and Xpanse, Strata Cloud Manager and the Prisma SD-WAN products as not affected. Its FAQ adds that GlobalProtect portal, gateway and Clientless VPN are not impacted, and neither is the Captive Portal.

WildFire and Cloud Rows Explained

The WildFire appliances WF-500 and WF-500-B show “None” in the affected column today. Palo Alto’s timeline says that on 23 October at 17:10 UTC it corrected their impact status. If a summary or a social post still lists WF-500 as affected, compare it with the advisory.

Palo Alto says two cloud services were affected earlier: Cortex XCORE (SaaS), patched on 21 October, and WildFire Cloud, patched on 22 October. Customers do not install anything for these.

Bridging the Gap Until You Install the Hotfix

These steps come from the workarounds section of Palo Alto’s advisory:

1. Restrict access to the management interface to trusted internal IP addresses. Palo Alto says this minimizes the risk and points to its best-practice guidance.
2. Check the permitted IP addresses on the management interface and on every interface with a management profile. In the web UI the profiles sit under Network, Network Profile, Interface Mgmt, says Palo Alto’s administrative access guide. Remove addresses you do not recognize.
3. With a Threat Prevention subscription, enable the 25 Threat IDs Palo Alto lists. The list is 543004, 97622 to 97625, 97643, 97647, 97649, 97652, 97653, 97656 to 97659, 97662 to 97664, 97670 to 97674 and 97676 to 97678. They need Applications and Threats content version 9162, 9163, 9164 or later.
4. For those Threat IDs to protect the management interface, Palo Alto says to route incoming management traffic through a data plane port. It also says to replace the certificate for inbound management traffic, decrypt that traffic so the firewall can inspect it, and enable threat prevention on it.
5. Customers with Frontier Virtual Patching (Advanced Threat Prevention Plus) on PAN-OS 12.2.4 and later received advance coverage. It came through Threat ID 543004, released at 10:21 PM Pacific Time on 20 October.

Spotting an Exposed Management Interface

Start with where the interface answers. From a host outside your network, such as a cloud virtual machine, see whether the management web interface opens on its HTTPS port. Send no exploit traffic. A login page that loads is enough evidence.

Teams that lose track of their devices can use external attack surface management to list every firewall address that faces the internet.

• Write down the management IP address of every PAN-OS firewall and every Panorama server.
• Read the version of each device and compare it with the hotfix calendar.
• List the interfaces that have a management profile attached, because Palo Alto says they are affected too.

Dream Reports 25 Rooted PAN-OS Servers

Dream’s research team published a report on 26 October and updated it on 29 October. Dream reports that one attacker chained PHP2Shell with Fragnesia (CVE-2026-46300), a Linux kernel privilege escalation flaw. It says the chain gave root on exposed PAN-OS firewalls in one HTTP request, with no credentials.

Dream describes the campaign as a funnel:

• FOFA, a Chinese internet search engine, found about 19,000 PAN-OS firewalls with the management interface on the internet.
• About 5,000 answered a version scan. Filtering by country and version left 240 targets in the US, Japan, Taiwan and South Korea.
• Automated runs rooted 24 firewalls and planted a web shell on each. A 25th server, reached later through a tunnel, completed the count.

Dream says the attacker built exploit profiles for PAN-OS 12.1 and 12.2, which run PHP 8.0.30, and chose targets on those branches. It also found two profiles for 11.1. There, Dream says, code ran as the low-privilege nobody user in a lab, but the full chain was not tuned.

Dream’s timeline starts with setup on 8 October. It says a firewall of a US government-affiliated organization was rooted on 23 October at 18:14 UTC and then crashed. A second one fell on 24 October at 10:09 UTC, and the attacker built a reverse SSH tunnel into the internal network.

Through that tunnel, Dream says, the attacker rooted the organization’s internal firewall management server. From there it decrypted an LDAP service account password and listed every Active Directory user and group. Dream cannot tell whether password spraying, backdoor accounts or SAML key theft worked.

Dream says the other 22 rooted firewalls kept only a web shell. It also describes the exploited web server as one that fronts the GlobalProtect portal. Palo Alto’s FAQ still lists the GlobalProtect portal, gateway and Clientless VPN as not impacted.

Attribution Is Not Settled

Dream names no threat actor. It reads these signs as pointing to a Chinese-nexus operation:

• Targets only in the US, Japan, Taiwan and South Korea.
• FOFA for recon and iox, a Chinese tunneling tool.
• An AI attack platform set up with the Chinese models DeepSeek and Kimi, with prompts in Chinese.
• Server clocks set to UTC+8.

These are indicators, not proof, so the attribution is not definitive. Dream writes that Unit 42 tracks the activity as CL-UNK-1280. Unit 42’s own brief does not use that name as of 30 October.

Unit 42: A Retraction, Then a Confirmation

On 23 October Unit 42, Palo Alto’s research team, added post-exploitation details to its PHP2Shell brief. On 25 October it retracted that update. It says the attack hit a European government agency in the context of a vulnerable PHP application, and it cannot confirm the access came through the PHP2Shell CVEs.

On 29 October Unit 42 updated the brief again. It says it independently verified the tooling of the attacker Dream reported and confirmed the reported results. Unit 42 says about 0.02% of Palo Alto’s installed base had management interfaces facing the internet and was impacted.

Unit 42 says it contacted each of these customers. It says customers who applied the available patches are not affected, because the fixes interrupt the observed exploit chain.

Cisco, Citrix and Fortinet Side by Side

PHP also sits inside appliances and tools from other vendors. This table shows what each vendor’s own advisory says.

Cisco’s advisory reached its final version 1.8 on 27 October. Its PSIRT says it knows of a public announcement but of no malicious use against Cisco products. Cisco says an attacker must be an authenticated administrator for Ultra-Reliable Wireless Backhaul.

Citrix’s advisory says its managed cloud services are already addressed. Citrix updated its remediation versions on 27 October. Fortinet’s advisory FG-IR-26-186 still lists three products as under investigation.

Latvia’s national cybersecurity team, on X, named four vendors early. Our search found 81 unique public posts on X from 21 to 23 October that name PAN-OS, Palo Alto or Panorama together with PHP2Shell or its CVE ids.

In Latvian; our translation: the flaws “may affect other products that use PHP”. CERT.LV names Cisco, Fortinet, Palo Alto Networks and Citrix NetScaler among them. Open the post on X (@certlv, 22 October).

Not the First PAN-OS Management Flaw

Management interfaces have been a weak spot for PAN-OS before. Our CVE-2026-0322 page covers a separate flaw. It lets an attacker who can log in and reach the interface run code as root, and CISA lists it as exploited. PHP2Shell is a different issue in PHP, so check both advisories for your devices.

Our PHP2Shell timeline follows how the first days of CVE-2026-109618 and CVE-2026-109619 unfolded. The post on the PHP session upload progress advisory covers a later PHP advisory. Palo Alto’s FAQ says its current analysis shows no impact of that advisory’s CVE-2026-115560 on PAN-OS. We will update this post when Palo Alto or Unit 42 publishes new findings.