Products and stacks · Firewalls, appliances and IT tools

PHP2Shell in PAN-OS: is it affected and how to fix it

How to check the PHP version PAN-OS uses

Run the command for your setup. A version at or above 8.2.35, 8.3.36, 8.4.27 or 8.5.12 in its branch is fixed; older branches are fixed only by a vendor build that says so.

show system info

The command-line php can differ from the PHP that serves the site. To be sure, check the web SAPI (a temporary phpinfo() page behind authentication, or the panel's PHP settings) and remove it afterwards. Our version checker compares a version number for you.

🔎 Got a version number? Paste it into the PHP2Shell checker →

How to fix PHP2Shell in PAN-OS

Restrict the management interface to trusted internal IPs; do not expose it to the internet.
If you rely on Threat IDs 543004 and 97622–97625, route management traffic through a data-plane port with decryption, otherwise the signatures do not see it.
Watch the advisory for fixed PAN-OS and Panorama versions and install them when they ship.
Until the vendor ships fixed PHP, the PHP-based interface should not be reachable from untrusted networks: restrict it to a management network, an IP allowlist or a VPN.
Install the vendor update as soon as it appears and re-check the version.

Prefer to let an AI agent do the checks? Check if you are affected · Fix with an AI agent

If you cannot patch yet

Set session.upload_progress.enabled = 0 where applications cannot override it (php.ini, php_admin_value in the FPM pool or Apache config), and restart PHP.
On PHP 8.5, set fatal_error_backtraces = 0.
PHP's interim advice also covers memory_limit and a low post_max_size; follow the remediation page exactly, because these settings only reduce some paths.
Restrict access (VPN, IP allowlist) or take the service offline if it runs PHP 8.1 or older with no vendor backport. WAF rules help but are not a fix.

FAQ

Is PAN-OS affected by PHP2Shell?

Affected, and the vendor has not shipped a fix yet. Palo Alto's advisory lists PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 (all versions) and Panorama as affected, with fixed versions "ETA: TBD". Prisma Access, Cloud NGFW, GlobalProtect App, Cortex products and Prisma Cloud are listed as unaffected. Threat Prevention customers are told to enable Threat IDs 543004 and 97622–97625 (content 9162 or later), which only protect the management interface if its inbound traffic is routed through a data-plane port and decrypted. Palo Alto says it is not aware of malicious exploitation against its products; its Unit 42 brief says it has seen proofs of concept.

Does updating PAN-OS itself fix CVE-2026-109618 and CVE-2026-109619?

Only if the update contains fixed PHP. PHP2Shell is a flaw in the PHP interpreter, so what matters is the PHP that PAN-OS runs on. Check the version after updating.

Which PHP versions fix PHP2Shell?

PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released 21 October 2026. PHP 8.1 and older get no release from the PHP project; only vendor builds with a backport (or a self-built source patch for 7.4, 8.0 and 8.1) fix them.

What if PAN-OS has no fix yet?

Keep its PHP-based web interface off the internet (VPN or IP allowlist), apply PHP's interim settings such as disabling session upload progress, and install the vendor update as soon as it ships. Interim settings reduce risk but are not a fix.

← All products that bundle PHP

Sources

Outbound links leave this site. We do not host exploit code.

Unofficial summary of public sources. This site is not affiliated with the vendor or the PHP project and hosts no exploit code.