Palo Alto Networks has identified two critical PHP remote code execution vulnerabilities that affect its PAN-OS and previously compromised two of its cloud services. These vulnerabilities, known as CVE-2026-109618 and CVE-2026-109619, have led the company to schedule firewall hotfixes and issue guidance to restrict access to management interfaces of affected systems. Despite the serious nature of these flaws, Palo Alto has not yet observed any malicious exploitation targeting its products. Nevertheless, its Unit 42 threat research team has seen proof-of-concept exploits for the broader PHP vulnerabilities, referred to as PHP2Shell. The vulnerabilities stem from PHP handling errors through the longjmp() function, which can leave unsafe memory exposed, allowing attackers to execute code remotely. CVE-2026-109618 is triggered by an out-of-memory error that leaves request memory uninitialized, while CVE-2026-109619 involves global memory references that point to memory that has already been freed. These issues enable attackers to execute code remotely by manipulating memory states. The underlying PHP vulnerabilities have been assigned a CVSS score of 9.2, and Palo Alto has rated their impact on its products at 8.7, indicating high severity. The affected PAN-OS branches include versions 10.2, 11.1, 11.2, 12.1, and 12.2 on PA-Series and VM-Series firewalls, as well as Panorama deployments. The exposure is limited to management web interfaces, such as the HTTPS administration console and XML API, with no impact on data plane interfaces unless a management profile is attached. Previously affected services, Cortex XCORE SaaS and WildFire Cloud, have already received fixes, while other services like Cloud NGFW and Prisma Access remain unaffected. Palo Alto plans to release PAN-OS hotfixes between October 26 and October 30, although these dates are estimates. Until these patches are available, administrators are advised to restrict management access to trusted internal IP addresses or a dedicated jump box. Internet-facing management interfaces pose the greatest risk. Administrators should also keep track of vendor updates, follow threat briefings from Unit 42, and enforce access restrictions until fixed versions of PAN-OS can be deployed. Additionally, threat prevention measures, including specific signatures, are available to mitigate risks associated with these vulnerabilities.