PHP2Shell statement record · Platform
Status in the company's own words: mitigation only. Statement dated 2026-10-21 (published and updated).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on security.paloaltonetworks.com, dated 2026-10-21 (published and updated). Source type: official page.
Advisory Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products
: PAN-OS 12.2, 12.1, 11.2, 11.1, 10.2 (all builds) and all Panorama versions affected; fixes in the upcoming releases
, ETA TBD. Not affected: Prisma Access, Cloud NGFW, Cortex XDR Agent, XSIAM, XSOAR, Xpanse, GlobalProtect App, Prisma Cloud and others. This issue strictly affects the management web interface, which includes the HTTPS web UI and XML API service.
quoted from https://security.paloaltonetworks.com/CVE-2026-109618. Mitigations: Threat Prevention IDs 543004, 97622 to 97625, restrict management access to trusted IPs. Not aware of malicious exploitation.
differs
Yes—some Palo Alto Networks products are affected, but patching is only partial. Its official advisory, updated October 23, 2026, covers both CVE-2026-109618 and CVE-2026-109619. | Product | Affected / patch status | |---|---| | PAN-OS 10.2, 11.1, 11.2, 12.1, 12.2 | All versions in these branches affected. No fixed releases listed; ETA TBD. | | Panorama | All versions
no status named
Based on the latest search results (as of October 23, 2026), here is a detailed answer: Palo Alto Networks & PHP2Shell (CVE-2026-109618 & CVE-2026-109619) ✅ Is Palo Alto Networks Affected? Yes. Palo Alto Networks lists all PAN-OS and Panorama versions as affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). 🔴 Has It Been Patched? No — not yet. Palo Alto said
match
Yes—but only some Palo Alto Networks products are affected. Palo Alto Networks lists all versions of PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 as affected, as well as Panorama. The advisory says the issue will be fixed in upcoming releases, but fixed versions and release dates were still listed as TBD in the latest update. Several other products are
no status named
Yes, Palo Alto Networks is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and permanent software fixes have yet been shipped. Affected Products & Status PAN-OS and Panorama: Palo Alto Networks confirmed that all versions of PAN-OS and appliance platforms are affected, with exposure restricted to the web management interface rather than core traffic routing. GlobalProtect: The GlobalProtect portal
no status named
Yes, Palo Alto Networks is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), specifically impacting the PAN-OS and Panorama management web interface (HTTPS web UI and XML API service). However, Palo Alto Networks has not yet released a direct PAN-OS software patch as of October 22, 2026, though fixed versions are planned for upcoming releases. What is Affected vs.
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Palo Alto Networks, PAN-OS and Panorama reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Palo Alto Networks, PAN-OS and Panorama's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Palo Alto Networks, PAN-OS and Panorama and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy