Palo Alto Networks has had a rough October, and it's worth walking through because the lesson applies to every firewall and VPN vendor, not just them. Disclosure, and it matters more than usual on this one: I work at Zscaler, a direct competitor. Read this as a competitor's take, but every fact here comes from public reporting and Palo Alto's own advisories, linked at the bottom.
The Bug That Was "Medium"
CVE-2026-0257 is an authentication bypass in GlobalProtect, Palo Alto's VPN, on PAN-OS firewalls and Prisma Access. The firewall trusts cookies without proper validation or integrity checks, so a remote, unauthenticated attacker can open a VPN session, sail past MFA, and land inside the network.
Here's the timeline that should bother everyone:
- May 13: Palo Alto discloses it and rates it medium severity. Patches ship in May.
- May 17: Rapid7 sees attackers going after local admin accounts.
- May 29: The advisory is updated to note limited exploit attempts on unpatched devices.
- Early June onward: Unit 42 starts investigating related intrusions.
- October 19 to 21: Unit 42 and ReliaQuest tie it to ransomware crews: Qilin, Inc, and Settra.
Five months later, it's still paying off for attackers, and ReliaQuest expects that to continue for at least another three months. The nastiest detail: ReliaQuest warns that patching alone may not remove access attackers already established. If you patched in July but someone got in in June, they may still be there.
Credit where it's due: Unit 42 is publishing this research about its own company's product. That's the right call, and not every vendor makes it.
PHP2Shell Lands on PAN-OS Too
Then PHP2Shell dropped, the critical PHP runtime bugs I wrote about earlier today. Palo Alto confirmed PAN-OS 10.2 through 12.2 on PA-Series and VM-Series firewalls are affected, plus Panorama, with no special configuration required. The exposure is the management web interface and XML API, or a dataplane interface with a management profile attached.
Palo Alto says it's not aware of malicious exploitation of its products. As of October 24, PAN-OS fixes were still scheduled, with estimated hotfixes landing October 26 through 30. Until then, the guidance is to lock management access down to trusted internal IPs or a jump box.
Notice what wasn't affected: Prisma Access, Cloud NGFW, and the GlobalProtect app itself. The cloud-delivered stuff was fine. The boxes customers run themselves were exposed. Hold that thought.
And this all comes right after CVE-2026-0322, the exploited PAN-OS management interface RCE I covered on October 15.
The Competitive Lens
This isn't really a Palo Alto problem. It's an appliance problem. Every vendor ships bugs, Zscaler included. The difference is what a bug can reach.
- A VPN is a public front door to your network. When its authentication breaks, the attacker isn't on a website. They're inside. That's why a "medium" bug turned into ransomware.
- Customer-run boxes depend on customer-run patching. Five months of exploitation tells you how that goes in the real world.
- Management interfaces keep ending up on the internet. Two PAN-OS management-plane issues in about two weeks. The guidance is always "restrict access," which means the safe state was never the default.
This is the core argument for Zero Trust architecture: users connect to specific apps, not networks, and there's no inbound listener sitting on the internet waiting to be tested. You can't bypass a VPN login page that doesn't exist.
If You Run Palo Alto, Do This
- Patch GlobalProtect for CVE-2026-0257, then kill all active sessions and disable authentication override cookies you don't need.
- Hunt, don't just patch. Look for unexpected sessions, including hostnames like "kali," and assume access may predate the fix.
- Pull PAN-OS and Panorama management interfaces off the internet today, and apply the PHP2Shell hotfixes as they land.
Bottom Line
Severity scores describe a bug. They don't describe what an attacker can do with your architecture. A medium-rated flaw on an internet-facing VPN is a critical flaw in practice, and October proved it. The fix isn't a better firewall. It's not needing the front door at all.
Sources: Help Net Security on CVE-2026-0257 and ransomware, Cybersecurity News on PHP2Shell and PAN-OS, and Canadian Centre for Cyber Security advisory on CVE-2026-0322