This week a PHP bug made it into firewall advisories. If you were wondering why Palo Alto, Fortinet and Cisco all posted about "PHP2Shell", here is the simple version.
What is PHP2Shell?
PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They can let an attacker run code on a web server without logging in. PHP released fixes around 22 October 2026. The details leaked a little early, and VulnCheck reproduced the bugs on 20 October.
Why does a firewall care? Because many appliances run PHP inside their web interfaces. If the management GUI uses PHP, the appliance can be affected.
How bad is it right now?
VulnCheck's early analysis says reliable code execution works on ARM64 systems and on x86 systems without ASLR. On normal x86-64 with ASLR, the public exploits don't work on their own yet. As of 22 October, Palo Alto, Fortinet and Cisco all said they were not aware of malicious use. But expect a lot of scanning, because everyone will try it.
What each vendor said (as of 22 October)
| Vendor | Status |
|---|---|
| Palo Alto Networks | All versions of PAN-OS and Panorama affected, no special config needed. Fixed releases not out yet. GlobalProtect portal and gateway, Cortex XDR Agent and Prisma Access listed as not affected. |
| Fortinet | FortiOS, FortiManager, FortiAnalyzer, FortiWeb, FortiMail, FortiClient, FortiSASE and others confirmed not affected. Twelve products (including FortiADC, FortiSIEM, FortiSOAR) still under investigation. FortiGuard virtual patches in version 37.316. |
| Cisco | Investigating 18 products and 13 cloud services (including Catalyst Center, ISE and Umbrella). No workarounds yet. |
What to do
- Palo Alto: make sure the management interface is only reachable from trusted internal IPs. That is the single most useful thing until fixed releases come. Threat IDs 543004, 97622, 97623, 97624 and 97625 add coverage.
- Your own PHP servers: update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your OS vendor's patched package. PHP 8.1 and older get no upstream fixes, so check if your distribution backports them.
- Watch the advisories. Palo Alto and Cisco were still working on fixes and product lists. Things will change this week.
- Look at your logs on internet-facing PHP servers: odd requests, PHP workers crashing, unexpected processes. Remember a lot of log noise will be just scanners.
My take
This is a good reminder that a firewall is also a web server, a Linux box and a bunch of libraries. A management interface open to the internet turns every library bug into your bug. Lock it down, and most of these stories become non-events.
Personal view only. This is moving fast, so always check the vendor advisories for the latest status.
Comments
No comments yet. Share your own debugging war story.