PAN-OS and Panorama are hit by the PHP flaws, with no fix date yet

PAN-OS and Panorama are hit by the PHP flaws, with no fix date yet

21 October 2026: Palo Alto Networks says every supported line of PAN-OS (12.2, 12.1, 11.2, 11.1 and 10.2) and Panorama is affected by CVE-2026-109618 and CVE-2026-109619, the critical PHP flaws fixed on 21 October, and that fixed releases have no date yet. It scores the impact on its products at CVSS-B 8.7 with moderate urgency, says the risk is highest where the management interface can be reached from outside, and knows of no exploitation against its products.

Not yet independently verified. Palo Alto gives no date for fixed PAN-OS or Panorama releases; we will add the versions when the advisory is updated. We will update this when it can be confirmed, and remove this note.

What is and is not affected

Palo Alto ties the exposure to the management interface of PAN-OS and Panorama, which is why access to it decides the risk. Palo Alto lists its cloud and agent products as unaffected: Cloud NGFW, Prisma Access, Prisma Access Agent, Prisma Cloud, the GlobalProtect app, Cortex XDR Agent, XSIAM, XSOAR, Xpanse, Bridgecrew and Idira. The score drops to 7.1 where management access is limited to a jump box, against PHP's own 9.2.

Stopgaps until the releases ship

Until fixed PAN-OS and Panorama versions arrive, Palo Alto offers three routes:

• Threat Prevention: customers with the subscription can enable Threat IDs 543004, 97622, 97623, 97624 and 97625, in Applications and Threats content version 9162 or later; on PAN-OS 12.2.4 or later with Advanced Threat Prevention Plus, virtual patching through Threat ID 543004 has applied since late on 20 October, Pacific time
• Inspect management traffic: route management traffic through a dataplane port, replace the inbound management certificate, decrypt it and apply threat prevention to inbound management services
• Restrict access: allow the management interface only from trusted internal addresses

The last is the cheapest and closes the most serious path, since the PHP flaws need no login. The same lesson from this month's GlobalProtect ransomware cases applies: a firewall's management plane should not answer the internet at all.

Other vendors are still counting

Cisco published its own advisory on the PHP flaws on 21 October and updated it the next morning. It rates the issue Critical but lists no products confirmed affected yet, with a long list still under investigation, among them Identity Services Engine, Catalyst Center, Catalyst SD-WAN Manager, Expressway, AppDynamics and Webex. Appliances with PHP-based web consoles will keep surfacing for weeks, and every one needs the same question asked of its vendor. Our PHP emergency release advisory covers the flaws themselves.

Related on TrustList:

• Ransomware gangs exploit a PAN-OS GlobalProtect bypass fixed since May
• FBI warns FortiBleed is still hitting exposed FortiGate VPNs
• Cisco Meraki hardening release covers seven flaw classes, top score 9.6

Sources

• Palo Alto Networks: Impact of critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks products, 21 October 2026
• Cisco: PHP vulnerabilities affecting Cisco products, October 2026 (cisco-sa-php-october26-Jj384Daq), 22 October 2026