Cybersecurity firms scramble to patch critical PHP2Shell flaws

Palo Alto Networks and Fortinet have confirmed their products contain vulnerabilities linked to PHP2Shell, a pair of critical flaws enabling unauthenticated remote code execution on web servers. The risks differ by vendor, but all three major cybersecurity firms—Palo Alto Networks, Fortinet, and Cisco—are still evaluating the full extent of exposure. Tracked as CVE-2026-109618 and CVE-2026-109619, these flaws have no confirmed workarounds, forcing customers to rely on temporary defenses until patches are released.

Palo Alto Networks confirms PAN-OS exposure, delays fixes

All versions of PAN-OS and Panorama are affected by the vulnerabilities, with no fixed releases available at this time. The highest risk occurs when a PAN-OS management interface accepts internet connections. While the company rates the threat as high, internal assessments suggest the primary danger is service disruption rather than data theft or unauthorized modifications.

Seven other Palo Alto Networks products remain unaffected, including Prisma Access, Cortex XDR, and Bridgecrew. Until patches are ready, the company advises restricting management interface access to trusted internal IP addresses and using its Frontier Virtual Patching service, which added threat prevention signatures on October 21—just hours after public disclosure.

Customers with Advanced Threat Prevention have received updated signatures (543004, 97622, 97623, 97624, 97625) to detect exploitation attempts. However, the absence of a fixed release leaves organizations dependent on these temporary measures until Palo Alto Networks updates its advisory with version numbers and release timelines.

Security researchers at VulnCheck confirmed the flaws on October 20, demonstrating they can execute remote code on ARM64 and x86 systems without Address Space Layout Randomization (ASLR). While dozens of proof-of-concept exploits have appeared on GitHub, most fail to fully implement the correct attack mechanism, and none bypass ASLR on x86-64 systems independently. On ARM64, however, ASLR can be brute-forced more easily, increasing risks for organizations using such hardware.

Fortinet investigates 12 products, excludes others

Fortinet is reviewing 12 products for potential exposure, including FortiADC, FortiDDoS, and FortiSIEM. The company has already confirmed that 12 others are not impacted, such as FortiOS, the operating system behind its FortiGate firewalls, and FortiClient for Windows, Linux, and macOS. Unlike Palo Alto Networks, Fortinet has not provided fixed versions or workarounds for the products under review.

The company’s FortiGuard Labs has released virtual patches for the vulnerabilities in version 37.316, targeting PHP servers broadly. For customers running outdated PHP versions (8.1 or older), Fortinet advises upgrading to a supported release or applying backported fixes from their operating system vendor. As of the report, fixes had been published by Ubuntu, Debian, and Alpine Linux 3.24, but not by RHEL, Amazon Linux, or SUSE.

Users of FortiWeb are urged to review web application protection policies and adjust inspection controls. FortiGuard also recommends isolating affected systems from untrusted networks, limiting web server request sizes, and monitoring for suspicious activity, such as unexpected PHP worker behavior or unusual access to application files, before reintegrating systems into production.

For now, Fortinet customers with vulnerable products remain in a holding pattern. The company has not ruled out future updates to its advisory as its investigation progresses.

The company is investigating 31 products and cloud services, including Cisco AI Defense, Catalyst Center, and AppDynamics, but its advisory lists no confirmed vulnerabilities or unaffected products. Cisco has stated there are no workarounds available and will update its advisory once the review is complete.

Fortinet’s PHP Server Mitigation Guidance

Fortinet’s FortiGuard Labs has provided specific guidance for PHP servers affected by the PHP2Shell vulnerabilities, even though the company has not yet confirmed which of its 12 products under review are exposed. The labs recommend upgrading PHP to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, as these include fixes for the flaws. Organizations unable to patch immediately should isolate affected systems from untrusted networks or temporarily disable exposed services.

Cisco’s Investigation Remains Unresolved

Cisco is still assessing the PHP2Shell vulnerabilities, with no products confirmed as vulnerable or unaffected. The company is reviewing 31 products and cloud services, including network security tools, management platforms, service provider routing software, wireless applications, and cloud services. Among the items under scrutiny are Cisco AI Defense, Catalyst Center, AppDynamics, and Webex, though Cisco has not disclosed whether any are exposed.

Cisco’s PSIRT team has not reported any malicious exploitation attempts linked to the flaws. If affected products are identified, Cisco will add them to its advisory with bug IDs in its Bug Search Tool, where workarounds and fixed software releases, if available, will be listed. Until then, organizations using Cisco products remain uncertain about their exposure.