{"id":12252,"date":"2026-10-26T13:34:55","date_gmt":"2026-10-26T19:34:55","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/"},"modified":"2026-10-26T13:35:43","modified_gmt":"2026-10-26T19:35:43","slug":"alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/","title":{"rendered":"Alert 2026-125 Critical vulnerabilities in Palo Alto PAN-OS (Brotli and PHP2Shell)"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Affected product(s):\u00a0<\/h2>\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Product<\/strong><\/td><td><strong>Vulnerability<\/strong><\/td><td><strong>Affected versions<\/strong><\/td><\/tr><tr><td><strong>PAN-OS 12.2 (PA-Series and VM-Series)<\/strong><\/td><td>Brotli and PHP2Shell<\/td><td>Earlier than 12.2.4-h1<\/td><\/tr><tr><td><strong>PAN-OS 12.1 (PA-Series and VM-Series)<\/strong><\/td><td>Brotli and PHP2Shell<\/td><td>Earlier than 12.1.4-h13, 12.1.7-h11 and 12.1.10-h3, depending on the base version<\/td><\/tr><tr><td><strong>PAN-OS 11.2 (PA-Series and VM-Series)<\/strong><\/td><td>Brotli<\/td><td>Earlier than 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4 and 11.2.16-h1, depending on the base version<\/td><\/tr><tr><td><strong>PAN-OS 11.2 (PA-Series and VM-Series)<\/strong><\/td><td>PHP2Shell<\/td><td>Earlier than 11.2.4-h23, 11.2.7-h23, 11.2.10-h16, 11.2.13-h4 and 11.2.16-h1, depending on the base version<\/td><\/tr><tr><td><strong>PAN-OS 11.1 (PA-Series and VM-Series)<\/strong><\/td><td>PHP2Shell<\/td><td>Earlier than 11.1.4-h38, 11.1.6-h40, 11.1.7-h12, 11.1.10-h36, 11.1.13-h16 and 11.1.16-h4, depending on the base version<\/td><\/tr><tr><td><strong>PAN-OS 10.2 (PA-Series and VM-Series)<\/strong><\/td><td>PHP2Shell<\/td><td>Earlier than 10.2.7-h39, 10.2.10-h42, 10.2.13-h27, 10.2.16-h12 and 10.2.18-h13, depending on the base version<\/td><\/tr><tr><td><strong>Panorama (virtual and M-Series)<\/strong><\/td><td>PHP2Shell<\/td><td>The same PAN-OS versions listed for each branch<\/td><\/tr><tr><td><strong>Prisma Cloud Application Security Transporter Client<\/strong><\/td><td>Brotli<\/td><td>Earlier than 0.2.9<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<p class=\"wp-block-paragraph\">Brotli only affects systems with Brotli inspection and TLS\/SSL decryption enabled; PHP2Shell affects the management web interface.<\/p>\n\n<h2 class=\"wp-block-heading\">Description<\/h2>\n\n<p class=\"wp-block-paragraph\">Two independent critical vulnerabilities affecting Palo Alto Networks PAN-OS have been published: one in Google&#8217;s Brotli decoder (CVE-2026-111497) and another in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The first is reachable through Brotli-compressed traffic inspected by the firewall; the second, through the management web interface. Palo Alto Networks stated that it is not aware of any malicious exploitation of either one.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>Brotli (CVE-2026-111497)<\/strong><\/p>\n\n<p class=\"wp-block-paragraph\">The vendor rates CVE-2026-111497 as CVSS v4.0 9.2 (critical); it is an out-of-bounds write (CWE-787) in the Brotli decoder (<code>c\/dec\/decode.c<\/code>). An unauthenticated remote attacker can use a manipulated Brotli-compressed stream to corrupt the decoder&#8217;s memory, disclose memory contents, cause a denial of service or potentially execute arbitrary code. In PAN-OS, this applies to PA-Series and VM-Series firewalls that have Brotli-compressed traffic inspection and TLS\/SSL decryption enabled in the dataplane. It does not affect the management interface (web or API), Panorama, or PAN-OS 11.1 and 10.2.<\/p>\n\n<p class=\"wp-block-paragraph\">Brotli inspection is not supported in PAN-OS 11.2.3 and earlier and has been disabled by default since PAN-OS 11.2.4, so only devices on which it was enabled are exposed. Prisma Cloud Application Security Transporter Client earlier than 0.2.9 is also affected. Palo Alto Networks SaaS services have already been remediated by the vendor and do not require customer action. For more details about Brotli\/Node2Shell, see the <a href=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/\">Alert 2026-124<\/a>.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>PHP2Shell (CVE-2026-109618 and CVE-2026-109619)<\/strong><\/p>\n\n<p class=\"wp-block-paragraph\">CVE-2026-109618 and CVE-2026-109619 are two PHP flaws in the handling of fatal errors with <code>longjmp()<\/code> that, according to the vendor, allow remote code execution: in the first, an out-of-memory error leaves request memory uninitialized; in the second, global memory is left pointing to already-freed regions. PHP assigned them CVSS v4.0 9.2; Palo Alto Networks rates the impact on its products at CVSS v4.0 8.7 (high, with an impact on availability) and notes that the risk is greater when management is accessible from the Internet.<\/p>\n\n<p class=\"wp-block-paragraph\">In PAN-OS, they affect PA-Series, VM-Series and Panorama (virtual and M-Series) in the 10.2, 11.1, 11.2, 12.1 and 12.2 branches, without requiring special configuration. Exposure is limited to the management web interface (HTTPS console and XML API); a dataplane interface is affected only if it has an associated management profile. GlobalProtect (portal, gateway and Clientless VPN) and Captive Portal are not affected. For more details about PHP2Shell, see the <a href=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-117-two-critical-vulnerabilities-in-php-with-pending-emergency-update\/\">Alert 2026-117<\/a>.<\/p>\n\n<p class=\"wp-block-paragraph\">Palo Alto Networks stated that it is not aware of any malicious exploitation of these vulnerabilities. Fixes are being released in phases: some hotfixes are already available, while others have only an estimated date (ETA), as detailed in the Solution section.<\/p>\n\n<h2 class=\"wp-block-heading\">Mitigation<\/h2>\n\n<p class=\"wp-block-paragraph\">Until the fixed versions are available, Palo Alto Networks recommends applying the following measures.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>Brotli (CVE-2026-111497)<\/strong><\/p>\n\n<p class=\"wp-block-paragraph\">Disable Brotli inspection via the CLI (PAN-OS 11.2.4 or later):<\/p>\n\n<pre class=\"wp-block-code\"><code>set system setting brotli-encoding disable<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">To verify that it has been disabled, run the following command and confirm that the output shows <code>Enabled: no<\/code>:<\/p>\n\n<pre class=\"wp-block-code\"><code>show system setting brotli<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">Alternatively, via the web interface (PAN-OS 12.1.2 or later):<\/p>\n\n<ol class=\"wp-block-list\">\n<li>Go to Device &gt; Setup &gt; Content-ID.<\/li>\n\n\n\n<li>In the Content-ID Settings panel, click the edit icon.<\/li>\n\n\n\n<li>Uncheck the Allow Brotli Encoding option.<\/li>\n\n\n\n<li>Confirm the changes (commit).<\/li>\n<\/ol>\n\n<p class=\"wp-block-paragraph\"><strong>Exposure verification<\/strong><\/p>\n\n<p class=\"wp-block-paragraph\">In PAN-OS 11.2.4 or later, run <code>show system setting brotli<\/code>: the firewall is only exposed if the output shows <code>Enabled: yes<\/code>. In PAN-OS 12.1.2 or later, check whether Allow Brotli Encoding is selected under Device &gt; Setup &gt; Content-ID.<\/p>\n\n<p class=\"wp-block-paragraph\">Customers with a Threat Prevention subscription have partial coverage by enabling Threat ID 97686 (Applications and Threats content 9165 or later).<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>PHP2Shell (CVE-2026-109618 and CVE-2026-109619)<\/strong><\/p>\n\n<ul class=\"wp-block-list\">\n<li>Restrict access to the management interface exclusively to trusted internal IP addresses, in accordance with the vendor&#8217;s best-practice guides; risk is further reduced if access is limited to a jump box that is the only authorized system.<\/li>\n\n\n\n<li>With a Threat Prevention subscription, enable Threat ID 543004 and the other signatures specified by the vendor (Applications and Threats content 9162, 9163 or 9164 and later). Threat ID 543004 is also available to customers with Frontier Virtual Patching (ATP Plus) in PAN-OS 12.2.4 or later.<\/li>\n\n\n\n<li>For these signatures to provide protection, traffic entering the MGT port must pass through a dataplane port (for example, through a management profile on a dataplane interface), the certificate for incoming management traffic must be replaced, that traffic must be decrypted so that the firewall can inspect it, and Threat Prevention must be enabled on management services.<\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\">These measures reduce risk but do not replace updating to a fixed version.<\/p>\n\n<h2 class=\"wp-block-heading\">Solution<\/h2>\n\n<p class=\"wp-block-paragraph\">The solution is to update each firewall to the fixed version of its branch or later, prioritizing devices with management accessible from untrusted networks or with Brotli enabled. The dates listed as ETA are vendor estimates as of 26\/10\/2026; those versions have not yet been released and the dates may change, so reviewing the vendor advisories is recommended. For devices affected by both flaws, target the fixed Brotli version of the branch, which is equal to or later than the PHP2Shell version.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>Brotli (CVE-2026-111497)<\/strong><\/p>\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Branch<\/strong><\/td><td><strong>Published hotfix<\/strong><\/td><td><strong>Pending hotfix (ETA)<\/strong><\/td><\/tr><tr><td><strong>PAN-OS 12.2<\/strong><\/td><td>None<\/td><td>12.2.4-h1 (28\/10)<\/td><\/tr><tr><td><strong>PAN-OS 12.1<\/strong><\/td><td>None<\/td><td>12.1.4-h13 (29\/10)<br \/>12.1.7-h11 (28\/10)<br \/>12.1.10-h3 (30\/10)<\/td><\/tr><tr><td><strong>PAN-OS 11.2<\/strong><\/td><td>None<\/td><td>11.2.4-h23 (30\/10)<br \/>11.2.7-h23 (29\/10)<br \/>11.2.10-h17 (27\/10)<br \/>11.2.13-h4 (27\/10)<br \/>11.2.16-h1 (28\/10)<\/td><\/tr><tr><td><strong>Prisma Cloud Application Security Transporter Client<\/strong><\/td><td>0.2.9<\/td><td>\u2014<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<p class=\"wp-block-paragraph\">PAN-OS 11.1, PAN-OS 10.2 and Panorama are not affected by this flaw.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>PHP2Shell (CVE-2026-109618 and CVE-2026-109619)<\/strong><\/p>\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Branch<\/strong><\/td><td><strong>Published hotfix<\/strong><\/td><td><strong>Pending hotfix (ETA)<\/strong><\/td><\/tr><tr><td><strong>PAN-OS 12.2<\/strong><\/td><td>None<\/td><td>12.2.4-h1 (28\/10)<\/td><\/tr><tr><td><strong>PAN-OS 12.1<\/strong><\/td><td>None<\/td><td>12.1.4-h13 (29\/10)<br \/>12.1.7-h11 (28\/10)<br \/>12.1.10-h3 (30\/10)<\/td><\/tr><tr><td><strong>PAN-OS 11.2<\/strong><\/td><td>11.2.10-h16<\/td><td>11.2.4-h23 (30\/10)<br \/>11.2.7-h23 (29\/10)<br \/>11.2.13-h4 (27\/10)<br \/>11.2.16-h1 (28\/10)<\/td><\/tr><tr><td><strong>PAN-OS 11.1<\/strong><\/td><td>11.1.4-h38<br \/>11.1.6-h40<br \/>11.1.10-h36<br \/>11.1.13-h16<br \/>11.1.16-h4<\/td><td>11.1.7-h12 (30\/10)<\/td><\/tr><tr><td><strong>PAN-OS 10.2<\/strong><\/td><td>10.2.18-h13<\/td><td>10.2.7-h39 (30\/10)<br \/>10.2.10-h42 (29\/10)<br \/>10.2.13-h27 (27\/10)<br \/>10.2.16-h12 (28\/10)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<p class=\"wp-block-paragraph\">These versions correspond to PAN-OS and apply to PA-Series and VM-Series firewalls and Panorama.<\/p>\n\n<h2 class=\"wp-block-heading\">Additional information:\u00a0<\/h2>\n\n<ul class=\"wp-block-list\">\n<li>Palo Alto Networks \u2014 CVE-2026-111497 advisory (Brotli in Palo Alto Networks products):<br \/><a href=\"https:\/\/security.paloaltonetworks.com\/CVE-2026-111497\" target=\"_blank\" rel=\"noopener\">https:\/\/security.paloaltonetworks.com\/CVE-2026-111497<\/a><\/li>\n\n\n\n<li>Palo Alto Networks \u2014 CVE-2026-109618 and CVE-2026-109619 advisory (PHP in Palo Alto Networks products):<br \/><a href=\"https:\/\/security.paloaltonetworks.com\/CVE-2026-109618\" target=\"_blank\" rel=\"noopener\">https:\/\/security.paloaltonetworks.com\/CVE-2026-109618<\/a><\/li>\n\n\n\n<li>Unit 42 \u2014 Threat Brief on CVE-2026-109618 and CVE-2026-109619:<br \/><a href=\"https:\/\/unit42.paloaltonetworks.com\/cve-2026-109618-cve-2026-109619\/\" target=\"_blank\" rel=\"noopener\">https:\/\/unit42.paloaltonetworks.com\/cve-2026-109618-cve-2026-109619\/<\/a><\/li>\n\n\n\n<li>Beacon Lab \u2014 Alert 2026-124, critical vulnerability in Node.js (Node2Shell \/ Brotli):<br \/><a href=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/\" target=\"_blank\" rel=\"noopener\">https:\/\/beaconlab.us\/publicacion\/alerta-2026-124-vulnerabilidad-critica-en-node-js-node2shell\/<\/a><\/li>\n\n\n\n<li>Beacon Lab \u2014 Alert 2026-117, critical vulnerabilities in PHP (PHP2Shell):<br \/><a href=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-117-two-critical-vulnerabilities-in-php-with-pending-emergency-update\/\" target=\"_blank\" rel=\"noopener\">https:\/\/beaconlab.us\/publicacion\/alerta-2026-117-dos-vulnerabilidades-criticas-en-php-con-actualizacion-de-emergencia-pendiente\/<\/a><\/li>\n<\/ul>\n","protected":false},"featured_media":12248,"template":"","class_list":["post-12252","publicacion","type-publicacion","status-publish","has-post-thumbnail","hentry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"Two critical flaws in PAN-OS: Brotli (CVE-2026-111497) and PHP2Shell (CVE-2026-109618 and 109619). Apply the hotfixes and review your exposure.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Beacon Lab - CSIRT by Cybolt\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Palo Alto PAN-OS: Critical Brotli and PHP2Shell Flaws\" \/>\n\t\t<meta property=\"og:description\" content=\"Two critical flaws in PAN-OS: Brotli (CVE-2026-111497) and PHP2Shell (CVE-2026-109618 and 109619). Apply the hotfixes and review your exposure.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-paloalto-2026-125-1200x630-1.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-paloalto-2026-125-1200x630-1.png\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-26T19:34:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-26T19:35:43+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@BeaconLabMX\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Palo Alto PAN-OS: Critical Brotli and PHP2Shell Flaws\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Two critical flaws in PAN-OS: Brotli (CVE-2026-111497) and PHP2Shell (CVE-2026-109618 and 109619). Apply the hotfixes and review your exposure.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-paloalto-2026-125-1200x630-1.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\\\/#listItem\",\"name\":\"Alert 2026-125 Critical vulnerabilities in Palo Alto PAN-OS (Brotli and PHP2Shell)\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\\\/#listItem\",\"position\":2,\"name\":\"Alert 2026-125 Critical vulnerabilities in Palo Alto PAN-OS (Brotli and PHP2Shell)\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"name\":\"Home\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"telephone\":\"+528007374357\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.mx\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/BeaconLab_V2-03.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/twitter.com\\\/BeaconLabMX\",\"https:\\\/\\\/www.linkedin.com\\\/showcase\\\/beaconlabmx\"]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\\\/#webpage\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\\\/\",\"name\":\"Palo Alto PAN-OS: Critical Brotli and PHP2Shell Flaws\",\"description\":\"Two critical flaws in PAN-OS: Brotli (CVE-2026-111497) and PHP2Shell (CVE-2026-109618 and 109619). Apply the hotfixes and review your exposure.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\\\/#breadcrumblist\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/paloalto-logo-destacada.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\\\/#mainImage\",\"width\":600,\"height\":600},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\\\/#mainImage\"},\"datePublished\":\"2026-10-26T13:34:55-06:00\",\"dateModified\":\"2026-10-26T13:35:43-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Palo Alto PAN-OS: Critical Brotli and PHP2Shell Flaws","description":"Two critical flaws in PAN-OS: Brotli (CVE-2026-111497) and PHP2Shell (CVE-2026-109618 and 109619). Apply the hotfixes and review your exposure.","canonical_url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BreadcrumbList","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/beaconlab.us\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/#listItem","name":"Alert 2026-125 Critical vulnerabilities in Palo Alto PAN-OS (Brotli and PHP2Shell)"}},{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/#listItem","position":2,"name":"Alert 2026-125 Critical vulnerabilities in Palo Alto PAN-OS (Brotli and PHP2Shell)","previousItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","name":"Home"}}]},{"@type":"Organization","@id":"https:\/\/beaconlab.us\/en\/#organization","name":"Beacon Lab","description":"CSIRT by Cybolt","url":"https:\/\/beaconlab.us\/en\/","telephone":"+528007374357","logo":{"@type":"ImageObject","url":"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/#organizationLogo"},"image":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/#organizationLogo"},"sameAs":["https:\/\/twitter.com\/BeaconLabMX","https:\/\/www.linkedin.com\/showcase\/beaconlabmx"]},{"@type":"WebPage","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/#webpage","url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/","name":"Palo Alto PAN-OS: Critical Brotli and PHP2Shell Flaws","description":"Two critical flaws in PAN-OS: Brotli (CVE-2026-111497) and PHP2Shell (CVE-2026-109618 and 109619). Apply the hotfixes and review your exposure.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/beaconlab.us\/en\/#website"},"breadcrumb":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/#breadcrumblist"},"image":{"@type":"ImageObject","url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/paloalto-logo-destacada.png","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/#mainImage","width":600,"height":600},"primaryImageOfPage":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/#mainImage"},"datePublished":"2026-10-26T13:34:55-06:00","dateModified":"2026-10-26T13:35:43-06:00"},{"@type":"WebSite","@id":"https:\/\/beaconlab.us\/en\/#website","url":"https:\/\/beaconlab.us\/en\/","name":"Beacon Lab","description":"CSIRT by Cybolt","inLanguage":"en-US","publisher":{"@id":"https:\/\/beaconlab.us\/en\/#organization"}}]},"og:locale":"en_US","og:site_name":"Beacon Lab - CSIRT by Cybolt","og:type":"article","og:title":"Palo Alto PAN-OS: Critical Brotli and PHP2Shell Flaws","og:description":"Two critical flaws in PAN-OS: Brotli (CVE-2026-111497) and PHP2Shell (CVE-2026-109618 and 109619). Apply the hotfixes and review your exposure.","og:url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/","og:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-paloalto-2026-125-1200x630-1.png","og:image:secure_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-paloalto-2026-125-1200x630-1.png","article:published_time":"2026-10-26T19:34:55+00:00","article:modified_time":"2026-10-26T19:35:43+00:00","twitter:card":"summary_large_image","twitter:site":"@BeaconLabMX","twitter:title":"Palo Alto PAN-OS: Critical Brotli and PHP2Shell Flaws","twitter:description":"Two critical flaws in PAN-OS: Brotli (CVE-2026-111497) and PHP2Shell (CVE-2026-109618 and 109619). Apply the hotfixes and review your exposure.","twitter:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-paloalto-2026-125-1200x630-1.png"},"aioseo_meta_data":{"post_id":"12252","title":"Palo Alto PAN-OS: Critical Brotli and PHP2Shell Flaws","description":"Two critical flaws in PAN-OS: Brotli (CVE-2026-111497) and PHP2Shell (CVE-2026-109618 and 109619). Apply the hotfixes and review your exposure.","keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"custom_image","og_image_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-paloalto-2026-125-1200x630-1.png","og_image_width":"0","og_image_height":"0","og_image_custom_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-paloalto-2026-125-1200x630-1.png","og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":true,"twitter_card":"default","twitter_image_type":"custom_image","twitter_image_url":null,"twitter_image_custom_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-paloalto-2026-125-1200x630-1.png","twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2026-10-26 19:35:43","updated":"2026-10-26 19:36:11","seo_analyzer_scan_date":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/beaconlab.us\/en\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tAlert 2026-125 Critical vulnerabilities in Palo Alto PAN-OS (Brotli and PHP2Shell)\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/beaconlab.us\/en\/"},{"label":"Alert 2026-125 Critical vulnerabilities in Palo Alto PAN-OS (Brotli and PHP2Shell)","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/"}],"_links":{"self":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12252","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion"}],"about":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/types\/publicacion"}],"version-history":[{"count":1,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12252\/revisions"}],"predecessor-version":[{"id":12253,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12252\/revisions\/12253"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media\/12248"}],"wp:attachment":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media?parent=12252"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}