Disclosure up front: I work at Zscaler, which competes directly with Palo Alto Networks. So yes, this is a competitor writing about a competitor. Every fact below comes from Palo Alto's own advisory and public reporting, linked at the end.
When I wrote about Palo Alto's October last weekend, the company said it wasn't aware of malicious exploitation of PHP2Shell against its products. That changed this week.
What Changed
Palo Alto's advisory for CVE-2026-109618 and CVE-2026-109619 now lists exploit maturity as "ATTACKED" and says active exploitation has been observed against PAN-OS management interfaces exposed to the internet. On October 27 it raised the advisory to Critical with the highest urgency.
The scope hasn't changed:
- Affected: PAN-OS 10.2 through 12.2 on PA-Series and VM-Series firewalls, and Panorama.
- Where: the management web interface (HTTPS UI and XML API). A dataplane interface is only exposed if a management profile is attached to it.
- Not affected: GlobalProtect portals and gateways, Captive Portal, Prisma Access, Cloud NGFW and most of the rest of the portfolio. Two cloud services (Cortex XCORE and WildFire Cloud) were affected and were fixed October 21 and 22.
Why This Probably Connects to Dream's Campaign
On Wednesday I covered Dream Research's write-up of an operator chaining PHP2Shell with the Fragnesia Linux kernel bug to root 24 firewalls and then go after Active Directory. Dream still hasn't named the firewall vendor, and I'm still not going to name it for them. The Hacker News points out that Cisco and Fortinet haven't reported malicious exploitation, which is circumstantial. Palo Alto's confirmation is the fact. The link is inference.
Credit Where It's Due
Palo Alto has handled the response well, and that's worth saying plainly:
- It shipped Threat Prevention coverage (Threat ID 543004) for Frontier Virtual Patching customers on October 20, the night before the advisory went out.
- It has published hotfixes across five PAN-OS branches in about a week, updating the advisory almost daily. As of October 29, every listed hotfix has shipped except 11.1.7-h12, still marked with an October 30 ETA.
- It says fewer than 0.01% of its installed base has an internet-facing management interface, and that it has contacted each potentially affected customer.
That last number is a good one. Most Palo Alto customers did the right thing.
The Architecture Point
Here's my competitor's take. This is the second exploited PAN-OS management-plane problem I've written about this month, after CVE-2026-0322, with the exploited GlobalProtect bug (CVE-2026-0257) in between. The bug this time isn't even Palo Alto's code. It's PHP, a runtime underneath the admin UI. That's the part I'd underline: any appliance with a web admin page carries every bug in the stack that serves that page, and when the page is reachable from the internet, you inherit the internet's attention.
Every vendor, Zscaler included, ships bugs. The question is how much of your attack surface sits in a box you have to patch yourself, and whether the safe configuration is the default or a recommendation you have to remember to follow.
What To Do
- Take the management interface off the internet today. Allow only trusted internal IPs or a jump box. Check dataplane interfaces for attached management profiles too.
- Apply the fixed PAN-OS release for your branch. The full table is in the advisory. If you're on 11.1.7, watch for 11.1.7-h12.
- Can't patch yet? Enable the Threat Prevention signatures listed in the advisory (content 9162 or later) on inbound management traffic, and follow Palo Alto's other interim steps.
- If your management interface was exposed at any point since October 21, treat it as a possible compromise. Look for webshells and new admin accounts, rotate credentials stored on the device (including LDAP service accounts), and patch Fragnesia (CVE-2026-46300), which CISA wants fixed by October 31.
- Running Panorama? Same advice, with more urgency. It manages everything else.
Update, October 31: Palo Alto's advisory changelog now shows every listed hotfix as released, including 11.1.7-h12, which shipped October 29. So there's no "waiting on my branch" excuse left. Unit 42 also updated its threat brief on October 29: it independently verified the PHP2Shell plus kernel-bug chain to root, and estimates that approximately .02% of Palo Alto's global installed base had internet-facing management interfaces that were configured and impacted. It says each affected customer has been contacted individually. (Palo Alto advisory, Unit 42)
Bottom Line
Palo Alto did a solid job on the response. The lesson is still the one we keep relearning: an admin page on the internet is an invitation, and attackers RSVP fast.
Sources: Palo Alto Networks advisory for CVE-2026-109618, The Hacker News, Help Net Security, and Unit 42 threat brief