PAN-OS
ProductVulnerabilities
2 CVEs in our records, 2 known exploited (on CISA's KEV list).
- CVE-2026-109618 Exploited added to KEV 26 Oct
- CVE-2026-109619 Exploited added to KEV 26 Oct
Am I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Affected versions
- CVE-2026-109619 from 10.2.7-h20, up to 10.2.7-h20
- CVE-2026-109619 from 10.2.7-h6, up to 10.2.7-h6
- CVE-2026-109619 from 10.2.7-h13, up to 10.2.7-h13
- CVE-2026-109619 from 10.2.7-h2, up to 10.2.7-h2
- CVE-2026-109619 from 10.2.7-h34, up to 10.2.7-h34
- CVE-2026-109619 from 10.2.7-h5, up to 10.2.7-h5
- CVE-2026-109619 from 10.2.7-h1, up to 10.2.7-h1
- CVE-2026-109619 from 10.2.7-h12, up to 10.2.7-h12
- CVE-2026-109619 from 10.2.7-h16, up to 10.2.7-h16
- CVE-2026-109619 from 10.2.7-h19, up to 10.2.7-h19
- CVE-2026-109619 from 10.2.7-h23, up to 10.2.7-h23
- CVE-2026-109619 from 10.2.7-h32, up to 10.2.7-h32
Security timeline
- Vulnerability reported by Kaspersky DailyPHP2Shell flaws remain unpatched on millions of servers as exploitation spreads
- Named in breach reports by GBHackersHackers chain PHP2Shell and Fragnesia flaws to gain root on Palo Alto firewalls
Recent news
PHP2Shell flaws remain unpatched on millions of servers as exploitation spreads
CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) allow unauthenticated remote code execution on PHP servers, and CISA has added both to its Known Exploited Vulnerabilities catalogue. Censys data suggests 29 million of 46 million scannable servers running vulnerable versions still had the flaws about two weeks after patches. A separate unpatched flaw, CVE-2026-115560, affects only unusual configurations and has a workaround.
Hackers chain PHP2Shell and Fragnesia flaws to gain root on Palo Alto firewalls
Attackers chained critical PHP2Shell remote code execution flaws with the Fragnesia Linux kernel flaw to gain root access on PAN-OS systems. The campaign reportedly compromised 24 internet-facing firewalls before reaching an internal firewall management server, bringing the total to 25 systems, according to Hunt.io's investigation citing Dream Research's analysis.