Palo Alto confirms PAN-OS management interfaces under active attack
Two critical PHP flaws in the PAN-OS management interface are being chained with a Linux kernel bug to gain root, and the advisory says roughly 0.02% of the installed base is exposed to the internet.
Palo Alto Networks has confirmed that attackers are actively exploiting two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, against PAN-OS management interfaces exposed to the internet. Both carry a CVSS score of 9.2 and allow unauthenticated remote code execution. Unit 42 says it has seen the two flaws chained with a separate Linux kernel bug to get root access on affected firewalls.
The bugs sit in how PHP handles out-of-memory errors during longjmp(), and only affect the management web interface, the HTTPS UI and XML API, not the data plane unless a management profile is attached there too. PAN-OS 10.2, 11.1, 11.2 and 12.1/12.2 all need the fix. Palo Alto’s advisory, last updated 29 October, points to 12.2.4-h1 or later and says roughly 0.02% of its installed base has a public-facing management interface.
Why it matters: if your PAN-OS management interface is reachable from the internet, this is one to patch today, not schedule for later. It is confirmed under active exploitation, not just disclosed. If you cannot patch immediately, restricting management access to trusted internal IPs is what Palo Alto says closes the exposure.