Mmastodon TechnologyCybersecurity first seen 1 d ago, last 1 d ago, peak #7
Palo Alto Networks rushes hotfixes for critical PHP2Shell flaws
Original: Daily brief, Oct 26: - PHP2Shell CVE-2026-109618/-109619 (CVSS 9.2): PAN-OS mgmt UI hotfixes 10.2.18-h13/11.1.16-h4/11.2
Palo Alto Networks has released emergency hotfixes for two critical vulnerabilities in the PAN-OS management interface, tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2 and dubbed PHP2Shell. Fixed builds include 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16, with remaining versions patched between October 27 and 30. Administrators are urged to patch PHP, disable session.upload_progress, and check logs for exploitation activity dating back to October 17.
Why now: Security teams are reacting to newly disclosed, remotely exploitable critical flaws in widely used firewalls with evidence of possible exploitation since mid-October.
Palo Alto NetworksPAN-OSCVE-2026-109618CVE-2026-109619
Evidence
- Daily brief, Oct 26: - PHP2Shell CVE-2026-109618/-109619 (CVSS 9.2): PAN-OS mgmt UI hotfixes 10.2.18-h13/11.1.16-h4/11.2.10-h16 out, rest Oct 27-30. Patch PHP, session.upload_progress.enabled=0, hunt since Oct 17 - Gheist: hunt ci-sync-* branches, UA gheist; rotate all repo… · tpsecurity@infosec.exchange · 1
API: https://socialmediatrends-api.osmike.com/v1/trends/3770549