Security · 30 October 2026
Palo Alto Networks Warns of Active Exploitation of PHP2Shell Vulnerabilities
Threat actors are exploiting CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) for unauthenticated RCE on internet‑exposed Palo Alto management interfaces; patches released by PHP Foundation on Oct 21 2026.
Why it matters
Prioritize updating PHP to 8.5.12 or later on all exposed Palo Alto interfaces; CVE‑2026‑109618/9 enable unauthenticated RCE.
For product managers
For your product
What does this mean for your product?
Try it on your product More from this issueAll AI news from 30 Oct →
Get this every morning, written for your product.
Deltaday reads the whole AI news cycle and tells you what changed, whether it's real yet, and what to do about it.