Guiding Customers Through Critical PHP Vulnerabilities
Palo Alto Networks, Monday, November 2nd, 2026
Palo Alto Networks urges partners to help customers respond to the PHP2Shell vulnerabilities with its Frontier Virtual Patching.
Palo Alto Networks says the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 matter because PHP powers more than half the web and enterprise patching averages 55 days.
It notes nearly 30 percent of vulnerabilities are weaponized within 24 hours and says telemetry showed autonomous agents probing exposed systems.
The company argues Frontier Virtual Patching should be enforced across all outbound traffic, not only endpoints, cloud or web application firewalls.
It calls on partners to educate customers about exposure and reachability and protect environments before exploits land.