Isolate Internet-Facing PAN-OS and Monitor Fortinet, Cisco Systems for PHP2Shell Exposure

Palo Alto Networks confirmed that every version of PAN-OS and Panorama is affected by PHP2Shell, a pair of critical PHP vulnerabilities. These flaws allow attackers to execute code on a web server without authenticating. The risk is highest when management interfaces accept connections from the internet. Palo Alto has not shipped fixed PAN-OS releases yet, leaving all customers potentially exposed to remote code execution attacks.

The risk

Fortinet’s PSIRT advisory rates CVE-2026-109618 as critical with a CVSS v3 score of 9.8, noting it is not known to be exploited. FortiGuard Labs rates both CVEs at 9.2 under CVSS 4.0. The vulnerabilities enable unauthenticated code execution on web servers. Because no fixed versions exist for the products currently under review, organizations face immediate exposure. The lack of confirmed exploitation does not eliminate the risk, as the attack path requires no login credentials.

Who is exposed

Fortinet is investigating 12 products, including FortiADC, FortiSIEM, FortiSOAR, and FortiEndpoint. It has cleared 12 other products, including FortiOS, FortiManager, and FortiWeb. Cisco is reviewing 31 products and cloud services but has not confirmed any vulnerable items. Cisco states no workarounds exist. Customers using products under investigation do not yet know if they are exposed. Palo Alto Networks confirmed all PAN-OS and Panorama versions are affected.

Cost and compliance

Fortinet’s advisory lists the virtual patch field as “No” for products under review. FortiGuard Labs released virtual patches for both CVEs in version 37.316. Ubuntu, Debian, and Alpine Linux 3.24 published fixes for the underlying PHP issues. RHEL, Amazon Linux, and SUSE had not published fixes at the time of the report. FortiCNAPP detects the CVEs in PHP packages from Linux repositories. FortiWeb customers are advised to review web application protection policies and request inspection controls.

Our take on the response

Vendors are moving at different speeds, with Palo Alto confirming widespread impact while Cisco and Fortinet remain in investigation phases. This inconsistency complicates enterprise risk management. Teams must assume exposure for any internet-facing management interface on PAN-OS devices immediately. For Fortinet and Cisco products, the lack of confirmed status means defensive posture adjustments are necessary while waiting for vendor updates.

What defenders should look for

Teams usually monitor web server logs for unusual POST requests to PHP endpoints that do not match normal application traffic. Check whether authentication logs show successful code execution without prior login attempts. Look for outbound connections from web servers to unknown external IP addresses, which may indicate command-and-control communication. Isolate affected systems from untrusted networks immediately. Temporarily switch off exposed services if traffic cannot be filtered. Review firewall rules to block direct internet access to management interfaces.

What to do and how to stay safe: Palo Alto Networks

• Upgrade PHP installations to version 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or apply vendor packages carrying the fix.
• Isolate systems running vulnerable PHP versions from untrusted networks or temporarily disable exposed web services.
• Review firewall rules to ensure management interfaces for PAN-OS, Fortinet, and Cisco products do not accept direct internet connections.
• Monitor web application logs for unauthenticated POST requests and unusual outbound traffic from web servers.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Palo Alto Networks products are affected by PHP2Shell?

All versions of PAN-OS and Panorama are affected by the PHP2Shell vulnerabilities.

Has Fortinet confirmed any products are vulnerable?

No, Fortinet is still investigating 12 products and has not confirmed any vulnerable items yet.

Are there any workarounds for Cisco products?

No, Cisco states that no workarounds exist for the products currently under review.