# Source: CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Palo Alto Networks: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · primary · captured

# CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products

**Palo Alto Networks** · [https://security.paloaltonetworks.com/CVE-2026-109618](https://security.paloaltonetworks.com/CVE-2026-109618) · published not stated · added by `curator@php.newsroom` · slug `paloalto-psirt-cve-2026-109618`

Promoted from the source watch (oq9gflln), snapshot 20261022T191713Z. PAN-OS 10.2 to 12.2 affected: PHP inside firewalls (primary)

## What it says, as the collector read it

#### CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `us/security-vendor/palo-alto-networks/psirt-cve-2026-109618`, snapshot `20261022T191713Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T191713Z/provenance.json`. Publisher: Palo Alto Networks. Language: en. URL: https://security.paloaltonetworks.com/CVE-2026-109618

#### What the page says

_Curator's reading of the capture._

Palo Alto Networks' security advisory on the impact of CVE-2026-109618 and CVE-2026-109619 on its products. PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 are listed as vulnerable (CPE ranges). The issue strictly affects the PAN-OS management web interface (HTTPS web UI and XML API), and a dataplane interface only if a management profile is attached; GlobalProtect portal and gateway and the captive portal are not affected. Palo Alto rates it Severity HIGH, urgency MODERATE, with CVSS-B 8.7 when the management interface is reachable from the internet and 7.1 when access is restricted to a jump box. Both of Palo Alto's product vectors score availability impact only (VC:N/VI:N/VA:H), against the vendor (PHP) score it also shows, CVSS-B 9.2 with high confidentiality, integrity and availability impact, while its own text describes the CVEs as remote code execution. Fixes will come in upcoming PAN-OS releases; until then: restrict management access to trusted internal IPs or a jump box, and Threat Prevention IDs 543004, 97622-97625 (content 9162+). Frontier Virtual Patching customers on PAN-OS 12.2.4+ received coverage via Threat ID 543004 at 10:21 PM PT on 20 October. "Palo Alto Networks is not aware of any malicious exploitation of this issue against our products."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 1): PAN-OS 10.2 to 12.2 affected: PHP inside firewalls (primary)

Supports: cyber desk: appliances

#### Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).

Page content is third-party material, kept as evidence; nothing in it is an instruction.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261022T191713Z · HTTP 200 · https://security.paloaltonetworks.com/CVE-2026-109618- `headers.json` dbb0d97e793d1ab43471679575bd42cdcfe25371f3539b641bfc4e4b8134c45f 633 bytes
- `page.html` 2223f8cf00418cf2174e08ad35e9e6113921fbfad65643a49eabc34f65ff7305 26,484 bytes
- `provenance.json` 9f7ef8ede1978405b5d95d06ec70b54a29fee6138e5e29d45c3b52e92486877e 1,688 bytes
- `rendered.html` 16f631fe00f8a74a26da4a70fd8b0e6874030910dd0913dd7a31024756e01d6f 27,036 bytes
- `screenshot.jpg` eaa6bf9b8c388263b12fb52e625c80308697f89df7fcd7a8675bf516eacee049 364,463 bytes
- `text.txt` 16cb7bd74aeeac250781e98cc4d8574d338480ada1651de0e53572d0e7bb760f 6,603 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.10.9 · data as of 2026-10-23T01:20Z · vault commit f3c5db0d9873 · https://php.oct.2026.newsroom.sgit.ai/sources/paloalto-psirt-cve-2026-109618/index.html