PHP2Shell RCE Exposes Palo Alto GlobalProtect VPN
Palo Alto Networks PAN-OS and Panorama servers are vulnerable to the PHP2Shell remote code execution flaw (CVE-2026-109618 and CVE-2026-109619). The vulnerabilities allow an unauthenticated attacker to execute arbitrary code on the web server that hosts the GlobalProtect VPN portal. The flaw was discovered in PHP 8.5 and earlier releases and was patched in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Attack Path and Exposure
The PHP2Shell vulnerability exploits a flaw in the PHP interpreter that parses user input without proper validation. An attacker can send a specially crafted HTTP request to the GlobalProtect portal, which is served by a PHP-based web application. The request bypasses authentication checks and injects code that the PHP engine executes with the privileges of the web server process. Because the GlobalProtect portal is exposed to the internet, the attack surface is large.
Affected Products and Versions
Palo Alto Networks confirmed that every released version of PAN-OS and Panorama is affected. The vendor has not yet issued a patched PAN-OS release. Administrators must either:
- Upgrade the underlying PHP runtime to a patched version (8.5.12 or newer) if the PAN-OS image allows it.
- Disable the PHP modules that expose the vulnerable code paths until a PAN-OS patch is available.
Evidence and Detection
Searchlight Cyber released an open-source scanner, php2shell-scanner, that probes a host for the two CVEs. The scanner sends the malformed request and checks for a characteristic response code. Running the scanner against a PAN-OS host that returns a 200 status with the injected payload indicates the host is vulnerable.
Mitigation Steps
- Verify PHP version on the PAN-OS host. If it is 8.5.11 or earlier, upgrade to 8.5.12 or later.
- If the PAN-OS image does not allow PHP upgrades, disable the PHP service or remove the vulnerable modules.
- Apply any PAN-OS patches that address the PHP2Shell flaw as soon as they are released.
- Monitor web server logs for anomalous requests that match the php2shell payload pattern.
- Consider implementing a Web Application Firewall (WAF) rule that blocks the specific request signature.
Broader Context
The PHP2Shell flaw was part of a broader PHP security release that fixed two critical vulnerabilities rated 9.2 under CVSS v4.0. The PHP security team urged all administrators to assume their installations could be affected until the patch was deployed. The same vulnerabilities were also reported to affect Fortinet, Cisco, and other vendors that run PHP in their web interfaces.
Next Steps for Security Teams
Security teams should run the php2shell-scanner against all PAN-OS and Panorama instances. If a host is found vulnerable, apply the PHP upgrade or disable the service immediately. Keep an eye on Palo Alto’s patch schedule; the vendor has not yet released a PAN-OS fix. In the interim, network segmentation and strict access controls can reduce the risk of exploitation.
Related Resources
For a comprehensive list of CVEs and their status, see the Zero-Day Vulnerability & CVE Exploit Matrix.
Related coverage
- Microsoft Patch Tuesday 2026: 1,417 Vulnerabilities Including Exploited Shell Bypass
- Hardware Wallet Spyware: New Crypto Device Found with Embedded Tracking Software