The PHP fix landed on 21 October, and since then it has become clear how many enterprise products quietly run PHP inside. Palo Alto Networks has confirmed that the flaws known as PHP2Shell affect all versions of PAN-OS and Panorama, and no fixed releases are available yet. Cisco is investigating 25 products and services, while Fortinet has cleared 34 of its own. Below is what the vendors themselves have confirmed, status as of 22 October 2026, 22:20 CEST.
What PHP2Shell is
CVE-2026-109618 and CVE-2026-109619 are two flaws in PHP itself, both rated 9.2 under CVSS 4.0. Both allow an attacker to run code on the server without authentication, using nothing more than a web request. The PHP team released the fixed versions PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. We described how the flaws work and how to update your own servers in our article PHP has shipped the fix for two critical flaws.
Why this matters even if you do not use PHP
Most organisations associate PHP with websites and online shops. It is also used inside finished products: in the management web interfaces of firewalls, in network management consoles, in NAS storage, in hosting and administration panels, in camera and access control systems. Administrators did not install that PHP, usually do not know it is there, and above all cannot update it themselves. They have to wait for firmware or a package from the vendor.
So it is not enough to review the servers where your developers knowingly run PHP. In advisory 2026-018, CERT-EU points out that products with embedded PHP can be affected even when they expose no PHP installation of their own, and refers to the public inventory maintained by the Dutch NCSC.
What the vendors have confirmed
The table summarises the status at vendors whose products are commonly used in mid-sized organisations. It is based on vendor advisories, not on media reports. The picture changes every few hours, so open the vendor advisory again before you act on it.
| Vendor | Products | Status on 22 October 2026, 22:20 CEST |
|---|---|---|
| Palo Alto Networks | PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 (all builds), Panorama | Affected, no fixed releases yet |
| Palo Alto Networks | Cloud NGFW, Prisma Access, Prisma Access Agent, Prisma Cloud, Cortex XDR Agent, Cortex XSOAR, Cortex XSIAM, Cortex Xpanse, GlobalProtect App, Bridgecrew, Idira | Not affected |
| Fortinet | FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR, FortiSOAR PaaS | Under investigation |
| Fortinet | 34 products, including FortiOS, FortiManager, FortiAnalyzer, FortiWeb, FortiProxy, FortiMail, FortiSIEM, FortiADC, FortiAuthenticator and FortiSASE | Not affected |
| Cisco | 25 products and services, including ISE, Catalyst Center, Catalyst SD-WAN Manager, Expressway, Nexus Dashboard Insights, Meraki, Webex and Splunk | Under investigation, no product confirmed affected so far |
| Cisco | Umbrella, Secure Email Threat Defense, AI Defense (hybrid on-premises), Policy Suite, Business Process Automation, Ultra Cloud Core PCF and SMI | Not affected |
| QNAP | Multiple products, listed by the vendor in advisory QSA-26-18 | Affected, the vendor is adding remediation progress to the advisory |
For PAN-OS it is worth knowing which part of the device is in scope. According to the Palo Alto Networks advisory, the issue strictly affects the management web interface, meaning the web console and the XML API service, plus dataplane interfaces that have a management profile attached. The GlobalProtect portal and gateway are not affected. The vendor rates the impact on its products as high with a score of 8.7, which is lower than the 9.2 assigned by the PHP maintainers, because its assessment sees an availability impact on PAN-OS rather than a data impact.
QNAP published its own statement on 22 October. Its PSIRT is reviewing the whole product portfolio and its cloud services, and it has issued advisory QSA-26-18, which according to the vendor covers multiple QNAP products. So follow that advisory directly for the specific products, versions and fix status, as QNAP keeps updating it.
The NCSC inventory is a useful starting point, but the vendor is faster. On 22 October, for example, Fortinet had already cleared FortiSIEM, FortiEndpoint, FortiADC Manager and FortiMonitor, while the NCSC list still showed them as under investigation at the same time. The repository itself states that entries are only investigation leads until a vendor confirms them.
What is known about exploitation
So far exploitation attempts are reported by security companies and vendors only. Amazon Threat Intelligence described a first attempt in its honeypot network on 17 October, four days before public disclosure, and a further wave on 21 October. Cloudflare and watchTowr also report attack attempts and broad scanning, although the reported scale differs between sources and part of the telemetry shows scanning only. QNAP states that it is tracking scanning and exploitation attempts and that it blocked attack attempts against its own website, online store and cloud services. According to the statement it has no evidence that data held on its online services was accessed.
Nobody has confirmed exploitation of a specific enterprise product. Palo Alto Networks and Cisco both state in their advisories that they are not aware of exploitation against their products, and Fortinet marks both flaws as not known to be exploited. Neither CVE is in the CISA KEV catalogue yet (version 2026.10.21). That can change within a day, which is why the steps below make sense even without a confirmed attack.
What to do now
- Build an inventory. Not only servers running PHP, but also devices and applications that may embed it: firewalls, management consoles, NAS boxes, hosting and administration panels, camera and access control systems. Record who updates each of them.
- Apply the temporary measures on PAN-OS and Panorama. Palo Alto Networks recommends restricting access to the management interface to trusted internal addresses or to a single jump host, and offers Threat Prevention subscribers signatures with Threat IDs 543004, 97622, 97623, 97624 and 97625 from content version 9162. There is no date for fixed PAN-OS releases, so follow the vendor advisory.
- Keep management interfaces off the internet. This applies to firewalls as well as to NAS boxes and consoles, and it will help with the next flaw of the same kind.
- Follow vendor advisories and the NCSC inventory. For products under investigation, decide who rechecks the status and when. The table above is valid as of the stated time, not as of today.
- Look for traces after patching. Focus on unusual processes spawned by PHP services, and look back at least to 17 October, the date of the first reported attempt.
Struggling to keep track?
We publish vulnerability alerts as they come and summarise them every Friday. Following them is only the first step. The harder part is knowing which vulnerabilities apply to you, in what order to address them and who in the organisation owns that work.
We help with that: security assessment and vulnerability management · external security manager · technology selection and deployment
A no-obligation consultation · Dealing with an incident right now?
We will tell you plainly what is worth addressing first. The initial consultation is free of charge.
Sources: PHP, advisory for CVE-2026-109618 · PHP, advisory for CVE-2026-109619 · Palo Alto Networks, impact on PAN-OS and Panorama · Fortinet PSIRT FG-IR-26-186, product status · Cisco, advisory cisco-sa-php-october26 · QNAP, statement on PHP2Shell and advisory QSA-26-18 · NCSC-NL, inventory of software with a PHP dependency · CERT-EU, advisory 2026-018 · Amazon Threat Intelligence, attempts before public disclosure · SecurityWeek, vendor responses