Correction, Oct. 26: An earlier version of this story, published Oct. 25, said attackers exploiting the PHP2Shell flaws had broken into a government body in Europe, based on an Oct. 23 update to a threat brief from Palo Alto Networks' Unit 42 research team. At 2:15 p.m. PT Oct. 25, Unit 42 retracted that update, saying it "is unable to confirm that initial access is associated with the specific PHP2Shell CVEs." The headline, summary and description of the intrusion have been revised.
Palo Alto Networks released its first firewall fixes for the PHP2Shell flaws this weekend, ahead of the Oct. 26 date it had estimated, while its Unit 42 research team withdrew an account that had tied an intrusion at a European government body to the bugs. The retraction leaves the question of confirmed real-world compromises open.
The Primary Wire reported Friday, citing The Register, that no PHP2Shell compromise had been publicly confirmed and that no fixed PAN-OS release had shipped.
What Happened
In an Oct. 23 update to its "Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619," Unit 42, Palo Alto's vendor research and incident-response arm, described an attack on a government entity in Europe that used agentic AI tooling after the initial break-in. TechCrunch reported the account Saturday. On Oct. 25, Unit 42 retracted that update. The brief now describes the activity as an attack "executed in the context of a vulnerable PHP application" and says Unit 42 cannot confirm that the PHP2Shell flaws were the way in.
Separately, Palo Alto released PAN-OS 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 on Oct. 25, and 11.1.4-h38, 11.1.6-h40, 11.1.10-h36 and 11.1.13-h16 on Oct. 26, according to its security advisory. The other 13 hotfixes carry estimates from Oct. 27 to Oct. 30. Panorama, the company's central management software, follows the same fixed versions. The company "is not aware of any malicious exploitation of this issue against our products."
Why It Matters
For boards and executives, the retraction is a reminder that early compromise reports can change, and that exposure is not the same as confirmed exploitation. Unit 42 still advises patching immediately and hunting for signs of compromise. Cortex Xpanse, Palo Alto's internet-scanning service, counts more than 22.6 million exposed instances potentially vulnerable, a measure of exposure rather than of victims.
Palo Alto customers on most PAN-OS versions remain unpatched for days. The flaw affects only the firewall's management web interface and XML API, not GlobalProtect VPN gateways. The company rates it 8.7 out of 10 when that interface is reachable over a network and 7.1 when only a single administrative jump server can reach it. Its main mitigation is limiting management access to trusted internal addresses, alongside threat signatures such as Threat ID 543004.
What to Watch
- Hotfixes due Oct. 27, 11.2.13-h4 and 10.2.13-h27, with the rest estimated through Oct. 30.
- The Known Exploited Vulnerabilities catalog of the Cybersecurity and Infrastructure Security Agency listed no PHP2Shell flaw as of Sunday; its newest entries are dated Oct. 23. A listing would set a deadline for federal agencies to patch.
- PHP's next regular release, which should fix a third flaw, CVE-2026-115560. Palo Alto says that flaw does not affect PAN-OS because it relies on "an uncommon configuration that is not used by PAN-OS." PHP's informational advisory and South Korea's Korea Internet & Security Agency, or KISA (guidance dated Oct. 24) recommend setting session.upload_progress.enabled=0 until then; KISA adds that PHP workers must be restarted.
- Whether Unit 42 or other researchers confirm real-world PHP2Shell compromises.
