Palo Alto Networks has no PAN-OS fix for PHP2Shell, calls it 9.2 and sells a paid virtual patch
Every version of Palo Alto's PAN-OS firewall software is on the PHP2Shell affected list with no fix shipped. The company scored its own products a notch below the emergency number its blog uses to sell virtual patching.
Richard Tang · 3 min read
Palo Alto Networks+2.41% — Palo Alto Networks, up 2.41 percent today has put every version of PAN-OS, the operating system behind its flagship firewalls, and Panorama, its management console, on the affected list for PHP2Shell, and no fixed release has shipped 1. The company's blog sells the same flaw as "the opening chapter" of an AI-accelerated threat cycle, answered by virtual patching, which blocks attack traffic at the network edge instead of fixing the software 2.
The emergency is real. So is the conflict: the vendor that owns the exposure also sells the shield, and its own patch has no date.
An AI-assisted flaw sits in the firewall's management plane
PHP2Shell is a pair of flaws in PHP, the scripting language behind most of the web, that let a web request run code on the server without a login 3. One corrupts memory during request cleanup, the other leaves stale state for the next request 3. PHP is embedded not only in websites but in appliances and management interfaces, where administrators cannot update the runtime themselves 4.
PAN-OS's management interface is that kind of surface, and Palo Alto says no special configuration is required to be exposed 1. AI did the finding: researchers at Wiz worked with Gemini and GPT-class models, and PHP's maintainers had their code scanned by an Anthropic$350B — Anthropic, private, latest valuation $350B frontier model 56.
The stopgap shipped before the fix
PHP shipped fixed releases on October 21 and called updating the only complete fix 3. Palo Alto's PAN-OS fixes are still on the way 1. Fortinet−0.38% — Fortinet, down 0.38 percent today cleared FortiOS, the software inside FortiGate firewalls, outright; Cisco−2.31% — Cisco, down 2.31 percent today is investigating 31 products and services 1. What Palo Alto could ship immediately was a blocking signature, delivered hours before PHP's fixes went public, inside its paid prevention portfolio 12. That is the offer this week: run an unfixed operating system, and subscribe to the vendor's shield while the vendor's patch is pending.
VulnCheck, reviewing the public exploit code, finds almost none of it implements the real attack, and none defeats ASLR, the memory-address randomization protecting x86 servers, though failed attempts will flood logs anyway 1. Palo Alto's own counts of exposure frame the era it is selling:
PHP2Shell's footprint dwarfs the edge-device emergencies Palo Alto compares it to
Data
| Value | |
|---|---|
| PHP2Shell (PHP) | 22,000,000 |
| NetScaler flaws | 50,000 |
| BeyondTrust | 16,000 |
Two severity scores, one vendor
The blog gives the flaw 9.2 on the ten-point severity scale the industry uses 2. The advisory gives Palo Alto's own products 8.7, moderate urgency, availability only: an outage, no data exposure, no tampering, and no explanation of the arithmetic 1. Fortinet's security team rates the same class of bug 9.8 1. Per-product scores can land lower honestly, so publish the reasoning.
CEO Nikesh Arora spent last week telling AI labs to "get off the fear-mongering business" 7, just as threat-intelligence firm Group-IB tied break-ins at FortiGate firewalls and GlobalProtect, Palo Alto's VPN, to a single crew 8. The stock is up 113% since April, with results due November 18 7.
AI finding flaws faster is a gain; it moves the bottleneck to remediation, which is solvable. PHP's fix came from a foundation of thirteen full- and part-time engineers 6. Virtual patching is the right interim layer, and Palo Alto's arrived fast. The party that closes the gap is still the party that ships the fix.
Until the PAN-OS patch lands, the customer holds the exposure and the vendor books the subscription.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
