CVE-2026-109618
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: pHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. EPSS 100% (100th percentile).
CISA federal remediation date Oct 29
Vulnerabilities · 1h ago
Palo Alto Networks says attackers are actively exploiting two PHP2Shell flaws against internet-exposed PAN-OS management interfaces, allowing code execution without authentication. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619.
When PHP runs out of memory, it can abruptly leave a request while other PHP state still points to memory that request used. Attackers can exploit that mismatch to run code without logging in, turning a reachable management interface into a foothold on the firewall’s control plane.
Dream separately reported a chain involving PHP2Shell and a Linux kernel flaw that rooted 25 servers and enabled attacks against Active Directory, but did not name the firewall vendor; a connection to Palo Alto’s warning remains unconfirmed. For organizations exposing PAN-OS or Panorama management surfaces, that uncertainty matters: a compromised control plane could put connected identity systems in scope, not just the firewall.
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: pHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. EPSS 100% (100th percentile).
CISA federal remediation date Oct 29
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: pHP has various global state that temporarily points into request memory. EPSS 100% (100th percentile).
CISA federal remediation date Oct 29
1 source covering this story
Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
Palo Alto Networks reports active PHP2Shell exploitation against internet-exposed PAN-OS management interfaces that allow unauthenticated RCE.
Vendor digest: Palo Alto Networks
Part of the PlainSec briefing for 2026-10-29