CVE-2026-109618 and CVE-2026-109619 in PHP - PanOS affected?

[patrickmatt]

Hi,

you probably heard about the CVEs mentioned above.

Details: CERT-EU - Critical Vulnerabilities in PHP

Is PanOS utilizing PHP and if yes what must be given to exploit the CVEs?

Thanks

[andber]

Palo has seemed to already pull their signature id's for the coverage. They aren't listed on the unit42 page anymore. So this isn't looking good. 

[andber]

Palo says the signatures are in content update version 9162 and it's in the release notes for that version, but they sure aren't when I downloaded it to panorama. 

[Adrian_Jensen]

---

@andber wrote:

Palo says the signatures are in content update version 9162 and it's in the release notes for that version, but they sure aren't when I downloaded it to panorama. 

---

I downloaded 9162 and none of the new vulnerability signatures appeared in my Vulnerability Protection profiles for 10+min. A stand-alone NGFW then suddenly started showing some, then all of them. Currently waiting to see if they appear on my HA pairs. Seems like something is taking a long time to process.

[andber]

I just checked an hour later and they are appearing in the same way for me too. Randomly and slowly. This doesn't make sense. 

[Adrian_Jensen]

A good 45-50min to appear on the active peer of one of my hardware HAs, a bit sooner on the passive peer. Another VM HA pair is an hour in from the update, the passive peer has been showing for ~20min, the active still shows nothing. Still missing threat ID 97621 on all. There may be indepth intrusion scanning occurring in the background as part of the signature install process. Nothing appearing in the system logs that seems relevant to when the signatures appear.

[patrickmatt]

Although Palo published teh official CVE the ticket is still not answered.
Anyway i commented that it can be closed.

Our MGMT Interface is seperated and secured.

[LeeFrancis2]

Why were these high profile PHP threat signatures not issued as a standalone Emergency Apps&Threats update ? 

PAN advise to consider delaying Apps and Threats update installation if new Apps are included in the release. Bundling these in 9162, that included 83 new app Ids, must have caused unwanted delay to many end user deployments, where that consideration meant a pause was triggered for manual review of the new Apps.

I hope all PAN-OS admins have checked and not overlooked this nuance.