Network & security appliances

PHP2Shell in Palo Alto, Fortinet and Cisco products

Some firewalls, management servers and cloud services embed PHP. You cannot patch it yourself: only the vendor’s fixed release closes it. Here is what each vendor has published so far.

Last reviewed 2026-10-23

Keep management interfaces off the internet

Until a fixed release ships, the most effective step for affected appliances is to limit management interfaces to trusted internal addresses and to apply the vendor’s threat signatures.

Palo Alto Networks

Affected, no fix yet

Advisory: CVE-2026-109618 security advisory · Advisory updated: 2026-10-21

Affected

PAN-OS 12.2, 12.1, 11.2, 11.1, 10.2 (all versions) · Panorama (all versions)

Not affected

Cloud NGFW · Prisma Access · Prisma Access Agent · Prisma Cloud · GlobalProtect App · Cortex XDR Agent · Cortex XSIAM · Cortex XSOAR · Cortex Xpanse · Bridgecrew · Idira

Fixed releases

None yet. Palo Alto lists the ETA as “TBD” for every PAN-OS branch and Panorama.

What to do now

Restrict management access to trusted internal IP addresses. With Threat Prevention, enable Threat IDs 543004, 97622, 97623, 97624 and 97625 (content version 9162 or later). Palo Alto says it is not aware of exploitation against its products.

Fortinet

Under investigation

Advisory: FG-IR-26-186 · Advisory updated: 2026-10-22

Under investigation

FortiADC · FortiADC Manager · FortiDDoS · FortiDDoS-F · FortiSIEM · FortiMonitor · FortiClient Cloud Services · FortiSOAR · FortiSOAR PaaS · FortiEndpoint

Not affected

FortiOS · FortiProxy · FortiManager · FortiAnalyzer · FortiWeb · FortiMail · FortiMail Cloud · FortiClient EMS · FortiClient (Windows, macOS, Linux, iOS, Android) · FortiSASE · FortiAuthenticator · FortiSwitch · FortiAP · FortiNAC · FortiNAC-F · FortiPAM · FortiDeceptor · FortiSandbox · FortiSandbox Cloud · FortiGate Cloud · FortiPortal

Fixed releases

None listed. Fortinet is still investigating the products below; FortiOS and FortiGate are not impacted.

What to do now

Track the advisory for the products you run. Fortinet published OT IPS signatures in package 37.316. No workaround is listed.

Cisco

Under investigation

Advisory: cisco-sa-php-october26-Jj384Daq (v1.2) · Advisory updated: 2026-10-22 14:13 UTC

Under investigation

Identity Services Engine (ISE) · Hypershield · Catalyst Center · Catalyst SD-WAN Manager · Nexus Dashboard Insights · WAN Automation Engine (WAE) · ASR 5000 Series (StarOS) · Ultra Cloud Core – Converged Policy and Charging · Expressway Series · Ultra-Reliable Wireless Backhaul (URWB) · Unified Industrial Wireless Software · AppDynamics PHP Agent · AppDynamics Secure Application (on-premises and SaaS) · Meraki · Splunk · Webex · Slido · CX Cloud · Security Cloud Control · IoT Control Center · Multicloud Defense · Secure Access · Vulnerability Management · Cisco+ Secure Connect

Not affected

AI Defense (hybrid on-premises) · Business Process Automation (BPA) · Policy Suite (CPS) · Ultra Cloud Core – Policy Control Function · Ultra Cloud Core – Subscriber Microservices Infrastructure · Secure Email Threat Defense · Umbrella

Fixed releases

None listed. Cisco says no product is currently known to be affected; fixed releases will appear per product in the Bug Search Tool.

What to do now

Track the advisory for the products you run. Cisco says there are no workarounds and it is not aware of malicious use.

Last reviewed: 2026-10-22

Other vendors

  • Germany’s BSI lists F5, Citrix NetScaler, Palo Alto, OPNsense, Netgate pfSense, QNAP, Synology and cPanel products as at least partly affected, and Cisco, WatchGuard, Sophos and Broadcom as not affected or still unknown (22 October). Check each vendor’s own advisory.
  • Use the NCSC-NL product inventory to find other products that bundle PHP, then confirm the status with each vendor.
  • Ask the vendor directly: “Does this product run PHP that processes network requests, and which release fixes CVE-2026-109618 and CVE-2026-109619?”
  • Appliances on a fixed vendor release still need a reboot or service restart if the vendor says so; check the release notes.

Questions

Is my FortiGate affected by PHP2Shell?+

No. Fortinet lists FortiOS, FortiProxy, FortiManager and FortiAnalyzer as not impacted. Several other Fortinet products are still under investigation; see the list above.

Is PAN-OS affected by PHP2Shell?+

Yes. Palo Alto Networks lists all PAN-OS 10.2–12.2 versions and Panorama as affected, with no fixed release yet. Restrict management access and enable the listed Threat IDs until a fix ships.

Can I update PHP on the appliance myself?+

No. Appliances run vendor-built firmware. Changing components yourself is unsupported and may not fix the issue. Wait for the vendor’s fixed release and reduce exposure in the meantime.

Related