Palo Alto Networks stock faces active PHP2Shell exploitation threat

Palo Alto Networks faces an active cybersecurity incident after its Unit 42 research team said on Thursday, October 29, that attackers are exploiting PHP2Shell vulnerabilities against internet-exposed PAN-OS management interfaces. Unit 42 said the campaign chained the PHP flaws with a Linux kernel privilege-escalation vulnerability to gain root access, and that its researchers independently verified the attacker's tooling and reported results.

The disclosure raises execution pressure for Palo Alto Networks because the exposure concerns the management layer of its firewall platform. Unit 42 said customers should immediately remove public internet access to management interfaces where enabled, restrict access to trusted internal IP addresses and apply the available PAN-OS fixes. The company said customers that have applied the patches are not affected because the fixes interrupt the observed exploit chain.

Critical Flaws Put Patching First

PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two remote-code-execution vulnerabilities carrying a CVSS 4.0 score of 9.2. Unit 42 described one flaw as involving uninitialized request memory after an out-of-memory error and the other as involving a pointer to freed memory. Together, the weaknesses can allow unauthenticated attackers to execute arbitrary code in vulnerable environments.

Unit 42 said Cortex Xpanse had identified more than 22.6 million exposed instances potentially vulnerable to the PHP flaws at the time of its initial publication. For Palo Alto Networks products, the company said the affected surface is concentrated in PAN-OS management interfaces and that its teams had individually contacted each impacted customer. The company also said only approximately 0.02 percent of its global installed base had internet-facing management interfaces configured and were impacted.

The company lists protection and mitigation across Advanced WildFire, Cortex XDR, Cortex XSIAM, Cortex Cloud, Prisma Cloud, Cortex Xpanse and its next-generation firewall products. It also said Advanced Threat Prevention signatures provide coverage, while customers should still assess exposure and patch immediately.

Investor Focus Shifts To Execution

For investors, the immediate issue is not only the severity of the vulnerabilities but also how quickly customers complete remediation. Palo Alto Networks has tied the risk to a configuration that its security guidance says should not expose management interfaces to the public internet. That limits the directly affected installed base, but the active-exploitation disclosure increases the need for customers to act before attackers can establish persistence.

Palo Alto Networks stock traded at 341.33 euros on Lang & Schwarz at 12:34 p.m. CEST on Friday, October 30, 2026. Investors can follow the real-time quote of Palo Alto Networks stock.

Unit 42 said Palo Alto Networks will continue investigating and provide further updates as necessary. The next operational milestone is the completion of customer patching and the removal of public exposure from any remaining management interfaces.

The broader market context is available through the S&P 500 market coverage.

More news and analyses on Palo Alto Networks stock are available on the company topic page.

Unit 42 published the threat brief and its October 29 update.