I’M UNDER A CYBER ATTACK

Alert

Alert 2026-125 Critical vulnerabilities in Palo Alto PAN-OS (Brotli and PHP2Shell)

Affected product(s): 

ProductVulnerabilityAffected versions
PAN-OS 12.2 (PA-Series and VM-Series)Brotli and PHP2ShellEarlier than 12.2.4-h1
PAN-OS 12.1 (PA-Series and VM-Series)Brotli and PHP2ShellEarlier than 12.1.4-h13, 12.1.7-h11 and 12.1.10-h3, depending on the base version
PAN-OS 11.2 (PA-Series and VM-Series)BrotliEarlier than 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4 and 11.2.16-h1, depending on the base version
PAN-OS 11.2 (PA-Series and VM-Series)PHP2ShellEarlier than 11.2.4-h23, 11.2.7-h23, 11.2.10-h16, 11.2.13-h4 and 11.2.16-h1, depending on the base version
PAN-OS 11.1 (PA-Series and VM-Series)PHP2ShellEarlier than 11.1.4-h38, 11.1.6-h40, 11.1.7-h12, 11.1.10-h36, 11.1.13-h16 and 11.1.16-h4, depending on the base version
PAN-OS 10.2 (PA-Series and VM-Series)PHP2ShellEarlier than 10.2.7-h39, 10.2.10-h42, 10.2.13-h27, 10.2.16-h12 and 10.2.18-h13, depending on the base version
Panorama (virtual and M-Series)PHP2ShellThe same PAN-OS versions listed for each branch
Prisma Cloud Application Security Transporter ClientBrotliEarlier than 0.2.9

Brotli only affects systems with Brotli inspection and TLS/SSL decryption enabled; PHP2Shell affects the management web interface.

Description

Two independent critical vulnerabilities affecting Palo Alto Networks PAN-OS have been published: one in Google’s Brotli decoder (CVE-2026-111497) and another in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The first is reachable through Brotli-compressed traffic inspected by the firewall; the second, through the management web interface. Palo Alto Networks stated that it is not aware of any malicious exploitation of either one.

Brotli (CVE-2026-111497)

The vendor rates CVE-2026-111497 as CVSS v4.0 9.2 (critical); it is an out-of-bounds write (CWE-787) in the Brotli decoder (c/dec/decode.c). An unauthenticated remote attacker can use a manipulated Brotli-compressed stream to corrupt the decoder’s memory, disclose memory contents, cause a denial of service or potentially execute arbitrary code. In PAN-OS, this applies to PA-Series and VM-Series firewalls that have Brotli-compressed traffic inspection and TLS/SSL decryption enabled in the dataplane. It does not affect the management interface (web or API), Panorama, or PAN-OS 11.1 and 10.2.

Brotli inspection is not supported in PAN-OS 11.2.3 and earlier and has been disabled by default since PAN-OS 11.2.4, so only devices on which it was enabled are exposed. Prisma Cloud Application Security Transporter Client earlier than 0.2.9 is also affected. Palo Alto Networks SaaS services have already been remediated by the vendor and do not require customer action. For more details about Brotli/Node2Shell, see the Alert 2026-124.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

CVE-2026-109618 and CVE-2026-109619 are two PHP flaws in the handling of fatal errors with longjmp() that, according to the vendor, allow remote code execution: in the first, an out-of-memory error leaves request memory uninitialized; in the second, global memory is left pointing to already-freed regions. PHP assigned them CVSS v4.0 9.2; Palo Alto Networks rates the impact on its products at CVSS v4.0 8.7 (high, with an impact on availability) and notes that the risk is greater when management is accessible from the Internet.

In PAN-OS, they affect PA-Series, VM-Series and Panorama (virtual and M-Series) in the 10.2, 11.1, 11.2, 12.1 and 12.2 branches, without requiring special configuration. Exposure is limited to the management web interface (HTTPS console and XML API); a dataplane interface is affected only if it has an associated management profile. GlobalProtect (portal, gateway and Clientless VPN) and Captive Portal are not affected. For more details about PHP2Shell, see the Alert 2026-117.

Palo Alto Networks stated that it is not aware of any malicious exploitation of these vulnerabilities. Fixes are being released in phases: some hotfixes are already available, while others have only an estimated date (ETA), as detailed in the Solution section.

Mitigation

Until the fixed versions are available, Palo Alto Networks recommends applying the following measures.

Brotli (CVE-2026-111497)

Disable Brotli inspection via the CLI (PAN-OS 11.2.4 or later):

set system setting brotli-encoding disable

To verify that it has been disabled, run the following command and confirm that the output shows Enabled: no:

show system setting brotli

Alternatively, via the web interface (PAN-OS 12.1.2 or later):

  1. Go to Device > Setup > Content-ID.
  2. In the Content-ID Settings panel, click the edit icon.
  3. Uncheck the Allow Brotli Encoding option.
  4. Confirm the changes (commit).

Exposure verification

In PAN-OS 11.2.4 or later, run show system setting brotli: the firewall is only exposed if the output shows Enabled: yes. In PAN-OS 12.1.2 or later, check whether Allow Brotli Encoding is selected under Device > Setup > Content-ID.

Customers with a Threat Prevention subscription have partial coverage by enabling Threat ID 97686 (Applications and Threats content 9165 or later).

PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

  • Restrict access to the management interface exclusively to trusted internal IP addresses, in accordance with the vendor’s best-practice guides; risk is further reduced if access is limited to a jump box that is the only authorized system.
  • With a Threat Prevention subscription, enable Threat ID 543004 and the other signatures specified by the vendor (Applications and Threats content 9162, 9163 or 9164 and later). Threat ID 543004 is also available to customers with Frontier Virtual Patching (ATP Plus) in PAN-OS 12.2.4 or later.
  • For these signatures to provide protection, traffic entering the MGT port must pass through a dataplane port (for example, through a management profile on a dataplane interface), the certificate for incoming management traffic must be replaced, that traffic must be decrypted so that the firewall can inspect it, and Threat Prevention must be enabled on management services.

These measures reduce risk but do not replace updating to a fixed version.

Solution

The solution is to update each firewall to the fixed version of its branch or later, prioritizing devices with management accessible from untrusted networks or with Brotli enabled. The dates listed as ETA are vendor estimates as of 26/10/2026; those versions have not yet been released and the dates may change, so reviewing the vendor advisories is recommended. For devices affected by both flaws, target the fixed Brotli version of the branch, which is equal to or later than the PHP2Shell version.

Brotli (CVE-2026-111497)

BranchPublished hotfixPending hotfix (ETA)
PAN-OS 12.2None12.2.4-h1 (28/10)
PAN-OS 12.1None12.1.4-h13 (29/10)
12.1.7-h11 (28/10)
12.1.10-h3 (30/10)
PAN-OS 11.2None11.2.4-h23 (30/10)
11.2.7-h23 (29/10)
11.2.10-h17 (27/10)
11.2.13-h4 (27/10)
11.2.16-h1 (28/10)
Prisma Cloud Application Security Transporter Client0.2.9—

PAN-OS 11.1, PAN-OS 10.2 and Panorama are not affected by this flaw.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

BranchPublished hotfixPending hotfix (ETA)
PAN-OS 12.2None12.2.4-h1 (28/10)
PAN-OS 12.1None12.1.4-h13 (29/10)
12.1.7-h11 (28/10)
12.1.10-h3 (30/10)
PAN-OS 11.211.2.10-h1611.2.4-h23 (30/10)
11.2.7-h23 (29/10)
11.2.13-h4 (27/10)
11.2.16-h1 (28/10)
PAN-OS 11.111.1.4-h38
11.1.6-h40
11.1.10-h36
11.1.13-h16
11.1.16-h4		11.1.7-h12 (30/10)
PAN-OS 10.210.2.18-h1310.2.7-h39 (30/10)
10.2.10-h42 (29/10)
10.2.13-h27 (27/10)
10.2.16-h12 (28/10)

These versions correspond to PAN-OS and apply to PA-Series and VM-Series firewalls and Panorama.

Additional information: