Palo Alto Networks says the two PHP2Shell flaws (CVE-2026-109618/109619, now in CISA KEV) affect the PAN-OS management web interface and XML API on PA-Series and VM-Series firewalls and on Panorama. Data-plane interfaces are only exposed if a management profile is attached. GlobalProtect portals, gateways and Captive Portal are not affected. PAN rates it 8.7 (High) for its products and says it is not aware of malicious exploitation against them.

• Fix status (Oct 27): hotfixes are out for some trains (for example 10.2.13-h27, 10.2.16-h12, 10.2.18-h13, 11.1.4-h38, 11.1.6-h40, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4 and 11.2.10-h16). Others are still scheduled: 11.2.13-h4 (Oct 27), 12.2.4-h1 (Oct 28), 11.2.16-h1 (Oct 28), 12.1.10-h3 (Oct 30), 11.2.4-h23 (Oct 30) and 10.2.7-h39 (Oct 30).
• Brotli (CVE-2026-111497, PAN rates 9.2): affects PAN-OS 11.2 and 12.x only when Brotli inspection and TLS decryption are enabled on the data plane. Brotli inspection is off by default from 11.2.4. The management interface is not affected. The same hotfixes cover both bugs, except that 11.2.10-h16 fixes only PHP and 11.2.10-h17 (due Oct 27) fixes both.
• Threat Prevention: signatures (Threat ID 543004 and others) only protect the management interface if its traffic is routed through a decrypted data-plane port.

What to do now: make sure the management UI and XML API are reachable only from a jump host or trusted internal addresses, never the internet. Apply the hotfix for your train as soon as it ships. If you don't need Brotli inspection, turn it off with set system setting brotli-encoding disable.