TL;DR: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical PHP remote code execution bugs. CISA added both CVEs to KEV on Oct 26. Palo Alto now rates Exploit Maturity as ATTACKED and says active exploitation has hit internet-exposed PAN-OS management interfaces. Cisco's PSIRT, as of its Oct 30 advisory, still reports no malicious use against Cisco products. Patch PAN-OS and affected Cisco gear, and keep management off the public internet. (Palo Alto, Cisco, CISA KEV)
Palo Alto Networks
| Item | Detail | Source |
|---|---|---|
| Severity | Vendor Critical 9.2 (CVSS v4.0) | Palo Alto |
| Affected | PAN-OS and Panorama management web UI and XML API. GlobalProtect portal, gateway and Clientless VPN are not affected | Palo Alto |
| Exploitation | Exploit Maturity ATTACKED. "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet." CISA KEV add for both CVEs: Oct 26, 2026 | Palo Alto, CISA KEV |
| Fixed (examples) | 12.2.4-h1; 12.1.10-h3 / 12.1.7-h11 / 12.1.4-h13; 11.2.16-h1 / 11.2.13-h4 / 11.2.10-h16 / 11.2.7-h23 / 11.2.4-h23; 11.1.16-h4 / 11.1.13-h16 / 11.1.10-h36 / 11.1.7-h12 / 11.1.6-h40 / 11.1.4-h38; 10.2.18-h13 / 10.2.16-h12 / 10.2.13-h27 / 10.2.10-h42 / 10.2.7-h39. Advisory has the full matrix | Palo Alto |
| Workaround | Restrict management access to trusted internal IPs. Threat Prevention customers can enable listed Threat IDs (content 9162+) with management traffic routed through a dataplane interface and decrypted | Palo Alto |
Cisco
| Product | Status | Source |
|---|---|---|
| Expressway and Expressway Select | Vulnerable; fix in 15.5.21; workaround in CSCwx37062 | Cisco |
| URWB / Unified Industrial Wireless | Vulnerable; fix 26.2.1.9 (Nov 2026 estimate); authenticated-admin exploit path (CVSS 6.6) | Cisco |
| Duo Access Gateway | Fixed in 3.2.0 | Cisco |
| ISE Portal Builder | Fix deployed; no customer action required | Cisco |
Cisco PSIRT (advisory v1.10, last updated Oct 30, 2026) says it is "not aware of any malicious use of these vulnerabilities against any Cisco product." Workarounds sit in the product bug IDs. (Cisco)
Related KEV note
CISA also added Linux kernel CVE-2026-46300 to KEV on Oct 28 and notes it can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. Treat that as a separate kernel patching track. (CISA KEV)