PHP2Shell Leaves Palo Alto Firewalls Exposed as Governments Go Dark

Palo Alto confirms all PAN-OS and Panorama versions are exposed and has no fixed release, after emergency PHP patches followed an AI-assisted discovery and a two-year delay the PHP Foundation calls a structural failure.

PHP has patches. Palo Alto Networks does not.

The firewall vendor’s advisory lists every version of PAN-OS and Panorama as affected by PHP2Shell, the nickname for two critical vulnerabilities in the PHP programming language.

Palo Alto said no fixed PAN-OS release is available yet and gave no estimate beyond “ETA: TBD.” Its advisory says no special configuration is required for exposure, and that the risk is highest when a management interface accepts connections from the internet.

The flaws are CVE-2026-109618 and CVE-2026-109619. Each carries a CVSS 4.0 score of 9.2. They sit in PHP’s memory management and error handling, and can let an unauthenticated attacker run code on a web server. Remote code execution means an attacker can execute commands on the machine without logging in.

PHP’s maintainers released fixed versions on Oct. 21: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project also published minimal source backports for PHP 7.4, 8.0 and 8.1; PHP 8.1 and older no longer receive normal security updates.

PHP runs an estimated 70% of websites, a figure Cloudflare attributes to W3Techs.

OpenAI said the trail began with AI-assisted research.

In a post published Oct. 21, OpenAI said Calif, a security firm, identified a critical flaw using its GPT-5.6 Sol model as part of OpenAI’s Patch the Planet program, while Wiz independently discovered and reported both vulnerabilities.

OpenAI called the findings “one of the most impactful security issues in recent memory.”

The PHP Foundation gave a more detailed account: Calif researcher Ryan A reported the flaw on Aug. 11, OpenAI independently reported the same root cause the same day, Wiz reported further attack vectors on Aug. 24, and OpenAI reported more on Sept. 18. The foundation said AI-assisted research has sharply increased the number of reports its small security team receives.

That team had seen one of the flaws before.

The PHP Foundation said a core developer found the first signs of CVE-2026-109618 in 2024, during PHP’s first external security audit in years, which was carried out by Quarkslab.

A potential exploit was theorized, but no concrete vector was found. The security team then drew up competing fixes.

Each carried a cost: one broke backward compatibility, another added a denial-of-service risk, and a third required changes to thousands of third-party extensions. The team ran on consensus, feared shipping the wrong choice, and lacked resources. Work stalled and restarted for months.

“We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources,” the Foundation wrote.

The release came early, after leaks.

On Oct. 20, the two CVE identifiers began circulating on forums and social media with a wrong release time and a wrong severity score of 10.0, the Foundation said. The real score is 9.2. PHP moved its release from Oct. 22 to Oct. 21.

Later that day, Calif mistakenly published a video showing its proof of concept against real targets.

On Oct. 21, more than six hours before the coordinated release, Chainguard published built images containing the fix, breaking an embargo.

Cloudflare said it deployed web application firewall protections about nine hours before public disclosure and observed attack traffic.

Governments moved before the patch in some cases. Public bodies in the Netherlands, Finland, Denmark, France and Canada took websites offline on Oct. 21, either to patch or to isolate systems they could not patch.

France’s Interior Ministry took local prefectures’ sites offline while it waited, Finland’s state IT provider Valtori pulled public services, and Denmark’s Kombit shut the national school communication platform, Reuters reported.

In the Netherlands, the NCSC took its own site down, and the lower house of parliament and the Port of Rotterdam also went offline, Dutch broadcaster NOS reported.

Canada’s AI minister, Evan Solomon, said some federal sites were taken down as a precaution on the advice of the Canadian Centre for Cyber Security.

Palo Alto’s customers face a different problem from PHP server operators.

The firewall’s management interface is the control point administrators use to protect the rest of the network, and Palo Alto says internet-facing management access is the highest-risk configuration. The company recommends restricting management access to trusted internal IP addresses or a jump box.

It said it is not aware of malicious exploitation against its products.

Several other products, including Cloud NGFW, Cortex XDR and Prisma Access, are listed as unaffected.

Fortinet said it is reviewing 12 products and has cleared 12, including FortiOS. Cisco said it is reviewing 31 products and cloud services and has no workarounds.

For PHP operators, the complete fix is an upgrade to one of the four fixed releases and a restart of the PHP workers or web server.

The PHP project’s interim measures include setting memory_limit to -1 and lowering post_max_size, but it says those reduce exposure to specific attack paths and do not make an installation safe.

Palo Alto’s advisory still says “ETA: TBD” for fixed PAN-OS releases. For its customers, the immediate control is network access to the management plane.