What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers

Palo Alto Networks has confirmed that every version of PAN-OS and Panorama is exposed to PHP2Shell, a duo of critical unauthenticated remote-code-execution flaws in PHP (CVE-2026-109618 and CVE-2026-109619), and it has not yet released patched PAN-OS builds. Fortinet and Cisco are still auditing their product lines — Fortinet is reviewing 12 solutions and has already cleared FortiOS and 11 others as unaffected, while Cisco is examining 31 products and cloud offerings, including ISE, with no confirmed status either way and no workarounds available. Proof-of-concept exploit code is already circulating publicly on GitHub, though researchers at VulnCheck say most of it is flawed and real-world attacks are currently limited mostly to ARM64 systems or x86 machines lacking ASLR protection, meaning the practical danger is narrower than the flood of exploit attempts in server logs might suggest. None of the three vendors report active exploitation against their own products so far, but customers are urged to restrict management-interface exposure and watch each vendor's advisory for updates.