What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers

Palo Alto Networks confirmed that PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web server without logging in. Palo Alto has released the first fixed PAN-OS versions and expects the rest by October 30. Fortinet and Cisco published their own advisories.

Customers running the products Fortinet and Cisco are still investigating do not yet know whether they are exposed, though Cisco has now confirmed three affected products and says workarounds are available for two of them.

Fortinet: 4 products under review, 43 cleared

Fortinet’s PSIRT advisory rates CVE-2026-109618 critical with a CVSS v3 score of 9.8 and lists it as not known to be exploited. FortiGuard Labs’ separate report rates both CVEs 9.2 under CVSS 4.0.

Four products are still under investigation: FortiDDoS, FortiClient Cloud Services, FortiSOAR and FortiSOAR PaaS.

Fortinet has confirmed that 43 entries on its list are not impacted, including FortiOS, FortiManager, FortiAnalyzer, FortiWeb, FortiMail, FortiClient, FortiSASE, FortiAuthenticator, FortiSwitch, FortiNAC, FortiADC, FortiClient EMS, FortiSIEM and FortiEDR. FortiOS, the operating system that runs FortiGate firewalls, is on the cleared list.

The PSIRT advisory gives no fixed versions or workarounds for the products under review, and its virtual patch field reads “No.” FortiGuard Labs covers mitigation in a separate report aimed at PHP servers in general. There, FortiGuard says it has released virtual patches for both CVEs in version 37.316 and IPS signatures in version 37.317. FortiCNAPP detects both CVEs in PHP packages installed from Linux distribution repositories. Ubuntu, Debian and Alpine Linux 3.24 had published fixes when the report went out, while RHEL and its rebuilds, Amazon Linux and SUSE had not, so FortiCNAPP findings for those may not list a fixed version yet. FortiWeb customers are advised to review their web application protection policies and request inspection controls.

FortiGuard’s advice for PHP servers:

• Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply the vendor package that carries the fix.
• Where patching has to wait, isolate affected systems from untrusted networks or temporarily switch off exposed services.
• Set web server or reverse proxy limits on request size, input fields, multipart sections, headers and nesting depth. Fortinet says these reduce exposure and do not substitute for patching.
• Check for suspicious web requests, unexpected PHP worker behavior, unexplained process execution and unusual access to application files or databases, starting with internet-facing systems, before putting them back into production.

PHP 8.1 and older no longer get security updates from the PHP project, so Fortinet tells customers on those versions to look for backported fixes from their operating system vendor or move to a supported release.

Cisco: four products vulnerable, 11 still under investigation

Cisco’s advisory rates the vulnerabilities critical. As of its October 23 update, Cisco lists these as vulnerable:

• Cisco Ultra-Reliable Wireless Backhaul (URWB): bug CSCwx37073, fix in release 27.1.1 (expected February 2027). An attacker must be authenticated as an administrator, which lowers the CVSS score to 6.6. A workaround is available.
• Cisco Expressway Series and Expressway Select Series: bug CSCwx37062, fix in release 15.5.21 (date to be determined). A workaround is available.
  Duo Access Gateway: fixed in version 3.2.0.

Cisco is still investigating 10 products and one cloud service:

• Network and content security: Identity Services Engine (ISE) Portal Builder
• Network management and provisioning: Catalyst SD-WAN Analytics, Catalyst SD-WAN Portal, Catalyst SD-WAN Validator, Software-Defined

Application Visibility and Control (SD-AVC), SD-AVC Cloud Connector

• Routing and switching: Catalyst 1300 Series Switches, Ultra Packet Core – Converged Policy and Charging
• Wireless: Unified Industrial Wireless Software
• Services: Smart Software Manager (SSM) On-Prem
• Cloud services: SD-WAN Cloud OnRamp

Cisco has confirmed that many products are not affected, including AI Defense, Hypershield, ISE, Catalyst Center, Catalyst SD-WAN Manager, Business Process Automation, WAN Automation Engine, ASR 5000 (StarOS), Policy Suite, IOS/IOS XE/IOS XR/NX-OS, the Secure Firewall line, the Meraki line, UCS Software, the AppDynamics products you listed, and cloud services including Umbrella, Secure Access, Slido, Webex, CX Cloud and Duo.

Workarounds are documented in the Cisco bug entries for the affected products. Cisco’s PSIRT says it is not aware of any malicious use of the vulnerabilities.

Palo Alto Networks: PAN-OS and Panorama affected, first fixes out, rest due by Oct. 30

Palo Alto’s advisory lists affected versions across the PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 branches, on PA-Series and VM-Series firewalls and on Panorama, with no special configuration needed to be exposed. Palo Alto says the flaw strictly affects the management web interface, which covers the HTTPS web UI and XML API. GlobalProtect and Captive Portal are not impacted. The advisory lists 21 products as unaffected, including Cloud NGFW, Prisma Access, GlobalProtect App, Cortex XDR Agent, Cortex XSIAM, Cortex XSOAR, Cortex Xpanse, Prisma Cloud and Strata Cloud Manager. Two of them, Cortex XCORE (SaaS) and WildFire Cloud, were affected earlier and were patched on October 21 and 22.

Palo Alto rates the issue high, with a CVSS-B score of 8.7 and moderate urgency, below the 9.2 the advisory lists as the vendor score. The scoring vector Palo Alto uses for its own products counts a high impact on availability and no impact on confidentiality or integrity, which in plain terms scores the risk to PAN-OS as an outage, with no data exposure or tampering. The advisory does not explain how Palo Alto reached that assessment. Limiting management interface access to a single jump box lowers the score to 7.1. Palo Alto says it is not aware of malicious exploitation against its products.

Palo Alto has now listed fixed PAN-OS releases for every affected branch. Three are already out: 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16. The other 17 carry estimated release dates between October 27 and October 30. Until the fixes are installed, Palo Alto recommends:

• Restricting management interface access to trusted internal IP addresses, following its best practice deployment guidelines.
• Relying on threat prevention coverage. Customers with Frontier Virtual Patching on PAN-OS 12.2.4 and later received Threat ID 543004 at 10:21 p.m. PT on October 20, hours before PHP published its fixes. Customers with a Threat Prevention subscription are covered by enabling 25 Threat IDs, including 543004 and 97622 through 97625, from content version 9162 and later. The coverage only works if management traffic is routed through a dataplane port, the inbound management certificate is replaced, inbound management traffic is decrypted, and threat prevention is enabled on it.

Most public exploit code doesn’t work yet

VulnCheck reproduced what it believes are both PHP2Shell bugs late on October 20, after details of the flaws leaked ahead of the planned release. The team’s early analysis is that the bugs can be exploited for remote code execution on ARM64 systems and on x86 systems without ASLR. Address space layout randomization (ASLR) shuffles where a program’s code and data sit in memory, so an exploit cannot rely on fixed addresses.

Dozens of proof-of-concept repositories have appeared on GitHub. VulnCheck, which is reviewing them as they come in, says only a very small number implement what it believes is the correct exploit mechanism, and none of those bypass ASLR on x86-64 systems on their own. On ARM64, VulnCheck says, ASLR can be brute-forced relatively easily.

VulnCheck still expects widespread exploit attempts built on public proofs of concept, whether or not the code works or the target can be exploited, so a flood of attempts in the logs will say little about whether a given server is at risk.

UPDATE: Monday, October 26, 2026 – 00:51 AM ET

Palo Alto Networks has published fixed PAN-OS versions for every affected branch, with three already released and the rest due between October 27 and 30, and now lists 21 products as unaffected.

Fortinet has narrowed its list of products under investigation from 12 to four (FortiDDoS, FortiClient Cloud Services, FortiSOAR and FortiSOAR PaaS) and now lists 43 entries as not impacted, including FortiADC, FortiSIEM and FortiClient EMS, which were previously under review.

Cisco has revised its advisory to list Ultra-Reliable Wireless Backhaul, Expressway and Duo Access Gateway as vulnerable, with workarounds available for the first two. It has also confirmed dozens of other products are not affected, and 11 products and services remain under investigation.

UPDATE: Thursday, October 22, 2026 – 08:05 AM ET

Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619.