topic Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected? in Next-Generation Firewall Discussions

CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

patrickmatt — Wed, 21 Oct 2026 10:09:07 GMT

Hi,

you probably heard about the CVEs mentioned above.

Details: CERT-EU - Critical Vulnerabilities in PHP

Is PanOS utilizing PHP and if yes what must be given to exploit the CVEs?

Thanks

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

BovenIJNetwerkbeheer — Wed, 21 Oct 2026 10:59:52 GMT

I like to know as well. There was a vulnerability in GlobalProtect in 2020 that suggests that GlobalProtect is using PHP:
https://security.paloaltonetworks.com/CVE-2020-1993

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

robertro — Wed, 21 Oct 2026 13:14:52 GMT

would like to know as well.

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

patrickmatt — Wed, 21 Oct 2026 13:27:14 GMT

fyi - i opened a case at 10/21/2026, 01:16 PM CEST with highest priority.
Talked to a Supporter some minutes after that and asked to escalate internally since a lot of customers (including me) want to know if PanOS is affected or not.
Did not hear antyhting since then but I will share answers here.

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

S.Christian392749 — Wed, 21 Oct 2026 14:53:16 GMT

i would like to know as well.

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

khsieh — Wed, 21 Oct 2026 15:00:27 GMT

I wonder if this is CVE-2026-0322 from October 14, 2026. Authenticated Remote Code Execution (RCE) in the Management Interface.
https://security.paloaltonetworks.com/CVE-2026-0322

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

andber — Wed, 21 Oct 2026 15:05:16 GMT

I'm more concerned about coverage for those that aren't running the 12.x code. How are us on 11.x code providing protection for our users? I don't see the CVE's listed in any of the release notes in the current dynamic updates.

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

Rtward1 — Wed, 21 Oct 2026 15:12:19 GMT

According to our rep threat prevention signatures are in process now.

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

kcobrien1 — Wed, 21 Oct 2026 16:37:55 GMT

Are there any updates yet from palo on protection here? When is the protection coming out for 11.1.6.X on these php vulns?

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

John.Colquitt.Adm — Wed, 21 Oct 2026 17:00:35 GMT

Any word on when these threat prevention signatures will be available?

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

andber — Wed, 21 Oct 2026 17:02:37 GMT

this has the sig numbers, but I'm not able to download them yet and they don't show up on threat vault yet

https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

A.Fletcher170593 — Wed, 21 Oct 2026 17:39:27 GMT

At 11am Central on 10/21/26, the Palo Alto advisory bulletin does indicate that both PAN-OS and Panorama are vulnerable. Patches haven't been released yet.

CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

robertro — Wed, 21 Oct 2026 17:54:20 GMT

the advisory says "risk in management interface access". what about globalprotect vpn portal? any info on this?

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

A.Fletcher170593 — Wed, 21 Oct 2026 19:43:25 GMT

The Advisory was updated about 20 minutes before this post. GlobalProtect portal and gateway are NOT affected by the PHP vulnerability. Here's a snippet of the FAQ from the advisory:

Q. Is GlobalProtect impacted?

GlobalProtect portal and gateway are not impacted.

Q. Is Captive Portal impacted?

The captive portal is not impacted.

Q. Which part of the PAN-OS product is affected?

This issue strictly affects the management web interface, which includes the HTTPS web UI and XML API service.

Q. Does it affect any standard dataplane interface, or specifically ones with a management profile attached?

It affects the dataplane interface only if a management profile is attached to it.

Q. When will PAN-OS fixes be available?

Patches will be made available as quickly as possible. Please monitor the security advisory for the latest information on mitigations and updates.

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

robertro — Wed, 21 Oct 2026 19:52:45 GMT

thank you

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

andber — Wed, 21 Oct 2026 20:22:20 GMT

Palo has seemed to already pull their signature id's for the coverage. They aren't listed on the unit42 page anymore. So this isn't looking good.

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

andber — Wed, 21 Oct 2026 23:52:38 GMT

Palo says the signatures are in content update version 9162 and it's in the release notes for that version, but they sure aren't when I downloaded it to panorama.

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

Adrian_Jensen — Thu, 22 Oct 2026 01:18:27 GMT

@andber wrote:

Palo says the signatures are in content update version 9162 and it's in the release notes for that version, but they sure aren't when I downloaded it to panorama.

I downloaded 9162 and none of the new vulnerability signatures appeared in my Vulnerability Protection profiles for 10+min. A stand-alone NGFW then suddenly started showing some, then all of them. Currently waiting to see if they appear on my HA pairs. Seems like something is taking a long time to process.

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

andber — Thu, 22 Oct 2026 01:22:21 GMT

I just checked an hour later and they are appearing in the same way for me too. Randomly and slowly. This doesn't make sense.

Re: CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

Adrian_Jensen — Thu, 22 Oct 2026 02:11:04 GMT

A good 45-50min to appear on the active peer of one of my hardware HAs, a bit sooner on the passive peer. Another VM HA pair is an hour in from the update, the passive peer has been showing for ~20min, the active still shows nothing. Still missing threat ID 97621 on all. There may be indepth intrusion scanning occurring in the background as part of the signature install process. Nothing appearing in the system logs that seems relevant to when the signatures appear.