Palo Alto Networks has identified two significant PHP remote code execution vulnerabilities within their PAN-OS software. These issues, tracked as CVE-2026-109618 and CVE-2026-109619, are currently being addressed with planned hotfixes and security recommendations to restrict access to management interfaces.
PHP RCE Vulnerabilities Explained
The vulnerabilities stem from PHP’s handling of errors through the longjmp() function, which can leave unsafe memory states. This flaw allows attackers to execute code remotely by exploiting uninitialized memory or stale memory references.
CVE-2026-109618 is triggered by an out-of-memory error that disrupts request processing, leaving memory uninitialized and vulnerable to exploitation. CVE-2026-109619 involves lingering references to freed memory, providing another opportunity for malicious code execution.
These PHP vulnerabilities have a CVSS score of 9.2, reflecting their severity. Palo Alto has rated the impact on their products as high, with an 8.7 score, primarily affecting system availability.
Impacted Systems and Versions
Affected systems include PAN-OS versions 10.2 through 12.2 across PA-Series and VM-Series firewalls, as well as Panorama deployments. Vulnerability exposure is confined to management interfaces, with no special configuration required for exploitation.
While Cortex XCORE SaaS and WildFire Cloud have received updates, other services remain unaffected. Scheduled hotfixes for PAN-OS are expected soon, starting from October 26, with additional fixes following through October 30.
Mitigation and Security Measures
Until official patches are released, administrators are advised to limit management interface access to trusted internal networks. Internet-facing interfaces present the highest risk, and temporary measures should not substitute for applying the finalized updates.
Palo Alto’s threat prevention includes signature 543004 and other updates for enhanced protection. Administrators should keep abreast of vendor updates and adjust their defenses accordingly, ensuring management traffic is securely routed and inspected.
Maintaining current threat intelligence and updating malware defenses are crucial for mitigating risks associated with these vulnerabilities. Security teams should integrate intelligence feeds to strengthen their security posture.
