{"resourceId":"pan-advisory-cve-2026-109618-php2shell-pan-os-management-interface-exploited-20261029","versions":[{"version":"external-ec21175b18fc743067a484c1436ce0fc2f36fadd383467b403d7d799894b2546","resource":{"id":"pan-advisory-cve-2026-109618-php2shell-pan-os-management-interface-exploited-20261029","title":"Palo Alto Networks security advisory: PHP2Shell (CVE-2026-109618/109619) affects PAN-OS management interfaces, active exploitation observed, fixed builds and Threat Prevention signatures listed","organization":"Palo Alto Networks Product Security","sector":"Network security / vendor vulnerability advisory","geography":"Global","publishedAt":"Palo Alto Networks security advisory, updated through late October 2026","publicationDate":null,"eventDate":"2026-10-29","sourceName":"Palo Alto Networks Security Advisories","sourceLabel":"CVE-2026-109618 Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products","sourceUrl":"https://security.paloaltonetworks.com/CVE-2026-109618","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["infrastructure","data-security"],"finding":"Palo Alto Networks states the PHP2Shell flaws apply to PAN-OS on PA-Series and VM-Series firewalls and Panorama, need no special configuration, and carry CVSS 4.0 9.2 when the management interface is reachable from the internet, dropping when access is restricted to a jump box. It states active exploitation has been observed against internet-exposed management interfaces. The advisory lists fixed hotfix builds for PAN-OS 10.2, 11.1, 11.2 and 12.1 lines, says Cortex XCORE SaaS and WildFire Cloud were previously impacted and patched on Oct. 21 and Oct. 22, and lists Threat Prevention signature IDs (including 543004, released Oct. 20 for Frontier Virtual Patching customers) with a requirement to route management traffic through a data-plane interface for the signatures to apply.","sledRelevance":"This is the authoritative fix list public-sector network teams will patch against; the signature workaround only works if management traffic is routed through a data-plane port, which many smaller agencies will not have configured.","evidence":"Opened and read the advisory page, including the product status table, severity variants, exploitation status, fixed-version table and workaround section.","architectureImplications":"Mitigation through signatures requires a management profile on a data-plane interface; otherwise the fix is upgrade plus management-plane restriction.","governanceImplications":"Vendor-assigned severity varies with exposure, so agencies need their own record of where management is reachable to set patch priority.","securityPrivacyImplications":"Exploitation yields code execution on the firewall itself; see the Dream and Unit 42 sources for observed post-exploitation.","caveats":"Vendor self-assessment; the page is live and changes, and the exact fixed-version list read tonight may be revised. Page shows no single publication date in extracted text.","streamIds":["palo-alto-networks"],"roles":{"sales":"Sales framing: the advisory is the vendor’s own statement that PAN-OS management interfaces exposed to the internet are being exploited through PHP2Shell. The customer problem for SLED network teams is turning a long, branch-specific fix table into a safe upgrade plan quickly. A bounded engagement could be patch planning and configuration validation. Advance signature coverage went to customers on a premium tier, which buyers may raise at renewal; the evidence does not support claims that signatures alone protect every customer.","engineering":"Engineering framing: the advisory sets the technical baseline. Score is highest when management is internet-reachable and lower behind a jump box. Signature protection needs management traffic routed through a data-plane interface, so many default deployments get no signature benefit. Validate by mapping every device to its maintenance branch and fixed hotfix, confirming signature IDs are enabled where used, and showing management is reachable only from trusted addresses. Note the WildFire Cloud and Cortex XCORE patches as vendor-side changes needing no customer action.","delivery":"Delivery framing: deliver a coordinated change: upgrade each device to its listed fixed build, restrict management access, and confirm signature configuration where it is relied on. The network operations team owns the change; the security team verifies. Acceptance should be a device-by-device record of build, management exposure and signature status. Risks include upgrade failures on older hardware, unsupported versions needing larger jumps, and assuming signatures apply when management traffic bypasses the data plane."},"roleDetails":{"sales":{"customerProblem":"Network teams must map many devices to branch-specific fixed builds under active exploitation.","stakeholders":["Network operations managers","CISOs","Change advisory boards","Managed service providers"],"discoveryQuestions":["Which PAN-OS branches and builds are deployed?","Is management traffic routed through a data-plane interface anywhere?","Which devices are on unsupported versions?"],"valueHypothesis":"Interpretation: structured patch planning shortens exposure time; no quantified benefit is available.","potentialEngagement":"A short PAN-OS patch-planning and configuration validation service against the advisory’s fixed-version table.","unsupportedClaims":["That Threat Prevention signatures protect devices whose management traffic bypasses the data plane","That the advisory reflects final fixed versions","Any count of SLED victims"]},"engineering":{"fit":"Applies to all PA-Series, VM-Series and Panorama deployments; Cloud-delivered services were patched by the vendor.","architectureIntegration":"Upgrade path per branch; optional signature workaround via data-plane management profile; jump-box restriction lowers score.","prerequisites":["Device and version inventory","Support entitlement for downloads","Threat Prevention subscription if signatures are used"],"constraints":["Unsupported versions require multi-step upgrades","Advisory is live and may change","Signature coverage tied to configuration and subscription"],"security":"Restrict management access to a jump box or trusted addresses immediately, independent of patch timing.","proofOfValue":["Device-to-fixed-build mapping complete","Management reachability tested from outside","Signature IDs confirmed enabled where relied upon"]},"delivery":{"work":"Plan and execute PAN-OS upgrades and management-access restrictions per the advisory.","dependencies":["Vendor fixed builds","Maintenance windows","Backup configurations"],"ownership":"Network operations owns upgrades; security validates exposure and signature status.","skillsAdoption":"Engineers need familiarity with PAN-OS hotfix trains and management profiles.","governanceCheckpoints":["Emergency change approval","Post-upgrade validation","Exception register for devices that cannot be upgraded"],"acceptanceCriteria":["Proposed: every device recorded with build and exposure status","Proposed: exceptions have compensating controls documented"],"risks":["Failed upgrades on aging hardware","Misread fixed-version table","Advisory updates after the plan is set"]}},"retrievedAt":"2026-10-30T03:07:17Z","enrichedAt":"2026-10-30T03:12:42Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"The many branch-specific hotfix paths increase upgrade-planning load on small network teams.","procurementImplications":"Advance coverage was tied to a premium subscription tier (ATP Plus with Frontier Virtual Patching), a consideration in renewal decisions.","operatingModelImplications":"Patch, restrict management access and verify signature configuration as one change package.","sourceVerification":{"openedUrl":"https://security.paloaltonetworks.com/CVE-2026-109618","referenceExcerpt":"Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}