CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

[patrickmatt]

Hi,

you probably heard about the CVEs mentioned above.

Details: CERT-EU - Critical Vulnerabilities in PHP

Is PanOS utilizing PHP and if yes what must be given to exploit the CVEs?

Thanks

[BovenIJNetwerkbeheer]

I like to know as well. There was a vulnerability in GlobalProtect in 2020 that suggests that GlobalProtect is using PHP:
https://security.paloaltonetworks.com/CVE-2020-1993

[robertro]

would like to know as well.

[patrickmatt]

fyi - i opened a case at 10/21/2026, 01:16 PM CEST with highest priority.
Talked to a Supporter some minutes after that and asked to escalate internally since a lot of customers (including me) want to know if PanOS is affected or not.
Did not hear antyhting since then but I will share answers here.

[S.Christian392749]

i would like to know as well.

[khsieh]

I wonder if this is CVE-2026-0322 from October 14, 2026. Authenticated Remote Code Execution (RCE) in the Management Interface. 
https://security.paloaltonetworks.com/CVE-2026-0322

[andber]

I'm more concerned about coverage for those that aren't running the 12.x code. How are us on 11.x code providing protection for our users? I don't see the CVE's listed in any of the release notes in the current dynamic updates. 

[Rtward1]

According to our rep threat prevention signatures are in process now.

[kcobrien1]

Are there any updates yet from palo on protection here?  When is the protection coming out for 11.1.6.X on these php vulns?

[John.Colquitt.Adm]

Any word on when these threat prevention signatures will be available?

[andber]

this has the sig numbers, but I'm not able to download them yet and they don't show up on threat vault yet

https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/

[A.Fletcher170593]

At 11am Central on 10/21/26, the Palo Alto advisory bulletin does indicate that both PAN-OS and Panorama are vulnerable. Patches haven't been released yet.

CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo...

[robertro]

the advisory says "risk in management interface access". what about globalprotect vpn portal? any info on this?

[A.Fletcher170593]

The Advisory was updated about 20 minutes before this post. GlobalProtect portal and gateway are NOT affected by the PHP vulnerability. Here's a snippet of the FAQ from the advisory:

Q. Is GlobalProtect impacted?

GlobalProtect portal and gateway are not impacted.

Q. Is Captive Portal impacted?

The captive portal is not impacted.

Q. Which part of the PAN-OS product is affected?

This issue strictly affects the management web interface, which includes the HTTPS web UI and XML API service.

Q. Does it affect any standard dataplane interface, or specifically ones with a management profile attached?

It affects the dataplane interface only if a management profile is attached to it.

Q. When will PAN-OS fixes be available?

Patches will be made available as quickly as possible. Please monitor the security advisory for the latest information on mitigations and updates.

[robertro]

thank you