--- title: "Palo Alto Networks has no PAN-OS fix for PHP2Shell, calls it 9.2 and sells a paid virtual patch" description: "Every version of Palo Alto's PAN-OS firewall software is on the PHP2Shell affected list with no fix shipped. The company scored its own products a notch below the emergency number its blog uses to sell virtual patching." publisher: "The Inference" section: "Security" published: 2026-10-22T16:10:48.732Z modified: 2026-10-22T16:10:48.732Z canonical: https://theinference.org/article/palo-alto-networks-has-no-pan-os-fix-for-php2shell-calls-it-9-2-and-sells-a-paid-virtual-patch language: en keywords: "Palo Alto Networks, Cybersecurity, Vulnerabilities, Firewalls, AI Security" --- # Palo Alto Networks has no PAN-OS fix for PHP2Shell, calls it 9.2 and sells a paid virtual patch > Every version of Palo Alto's PAN-OS firewall software is on the PHP2Shell affected list with no fix shipped. The company scored its own products a notch below the emergency number its blog uses to sell virtual patching. [Palo Alto Networks](https://theinference.org/markets/companies/palo-alto-networks) has put every version of PAN-OS, the operating system behind its flagship firewalls, and Panorama, its management console, on the affected list for PHP2Shell, and [no fixed release has shipped](https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/) [1]. The company's blog sells the same flaw as "the opening chapter" of an AI-accelerated threat cycle, answered by virtual patching, which blocks attack traffic at the network edge instead of fixing the software [2]. The emergency is real. So is the conflict: the vendor that owns the exposure also sells the shield, and its own patch has no date. ## An AI-assisted flaw sits in the firewall's management plane PHP2Shell is a pair of flaws in PHP, the scripting language behind most of the web, that let a web request run code on the server without a login [3]. One corrupts memory during request cleanup, the other leaves stale state for the next request [3]. [PHP is embedded not only in websites but in appliances and management interfaces, where administrators cannot update the runtime themselves](https://github.com/NCSC-NL/php2shell) [4]. PAN-OS's management interface is that kind of surface, and Palo Alto says no special configuration is required to be exposed [1]. AI did the finding: [researchers at Wiz worked with Gemini and GPT-class models](https://en.m.wikipedia.org/wiki/PHP2Shell), and PHP's maintainers had their code scanned by an [Anthropic](https://theinference.org/markets/companies/anthropic) frontier model [5][6]. ## The stopgap shipped before the fix [PHP shipped fixed releases on October 21 and called updating the only complete fix](https://www.php.net/archive/2026.php) [3]. Palo Alto's PAN-OS fixes are still on the way [1]. [Fortinet](https://theinference.org/markets/companies/fortinet) cleared FortiOS, the software inside FortiGate firewalls, outright; [Cisco](https://theinference.org/markets/companies/cisco) is investigating 31 products and services [1]. What Palo Alto could ship immediately was [a blocking signature, delivered hours before PHP's fixes went public, inside its paid prevention portfolio](https://www.paloaltonetworks.com/blog/2026/10/millions-of-php-instances-exposed-what-organizations-need-to-do-right-now/) [1][2]. That is the offer this week: run an unfixed operating system, and subscribe to the vendor's shield while the vendor's patch is pending. VulnCheck, reviewing the public exploit code, finds almost none of it implements the real attack, and none defeats ASLR, the memory-address randomization protecting x86 servers, though failed attempts will flood logs anyway [1]. Palo Alto's own counts of exposure frame the era it is selling: *Chart: **PHP2Shell's footprint dwarfs the edge-device emergencies Palo Alto compares it to** Bar chart comparing internet-facing exposure counts: PHP at 22 million instances, NetScaler at roughly 50,000, BeyondTrust at roughly 16,000.* *Internet-facing instances exposed or potentially vulnerable, as counted by Palo Alto Networks in October 2026; the vendor uses the comparison to argue manual patching cannot match open-source scale. [2]* ## Two severity scores, one vendor The blog gives the flaw 9.2 on the ten-point severity scale the industry uses [2]. The advisory gives Palo Alto's own products 8.7, moderate urgency, availability only: an outage, no data exposure, no tampering, and no explanation of the arithmetic [1]. Fortinet's security team rates the same class of bug 9.8 [1]. Per-product scores can land lower honestly, so publish the reasoning. CEO [Nikesh Arora](https://theinference.org/markets/people/nikesh-arora) spent last week [telling AI labs to "get off the fear-mongering business"](https://www.thestreet.com/technology/palo-alto-networks-panw-ai-cybersecurity-strategy) [7], just as threat-intelligence firm Group-IB [tied break-ins at FortiGate firewalls and GlobalProtect, Palo Alto's VPN, to a single crew](https://cybersecuritynews.com/breaking-into-fortigate-fortiweb/) [8]. The stock is up 113% since April, with results due November 18 [7]. AI finding flaws faster is a gain; it moves the bottleneck to remediation, which is solvable. PHP's fix came from [a foundation of thirteen full- and part-time engineers](https://www.theguardian.com/technology/2026/oct/22/what-is-php-computer-language-flaw-causing-global-website-shutdowns) [6]. Virtual patching is the right interim layer, and Palo Alto's arrived fast. The party that closes the gap is still the party that ships the fix. Until the PAN-OS patch lands, the customer holds the exposure and the vendor books the subscription. ## Takeaway Every PAN-OS version is exposed to PHP2Shell with no fix shipped, and Palo Alto scored its own products 8.7 while its blog scores the flaw 9.2 and sells the virtual patch that stands in for the fix. ## Sources 1. [Help Net Security, "What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers", 22 October 2026](https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/) 2. [Palo Alto Networks blog, "Millions of PHP Instances Exposed: What Organizations Need To Do Right Now", October 2026](https://www.paloaltonetworks.com/blog/2026/10/millions-of-php-instances-exposed-what-organizations-need-to-do-right-now/) 3. [PHP.net, "Security advisory: Critical remote code execution vulnerabilities, update now" (2026 news archive), 21 October 2026](https://www.php.net/archive/2026.php) 4. [NCSC-NL, "php2shell" operational repository (GitHub), updated 22 October 2026](https://github.com/NCSC-NL/php2shell) 5. [Wikipedia, "PHP2Shell", 22 October 2026](https://en.m.wikipedia.org/wiki/PHP2Shell) 6. [The Guardian, "What is PHP, and how bad is the computer language flaw causing website shutdowns globally?", 22 October 2026](https://www.theguardian.com/technology/2026/oct/22/what-is-php-computer-language-flaw-causing-global-website-shutdowns) 7. [TheStreet, "Palo Alto CEO wants AI labs out of the 'fear-mongering business'", 19 October 2026](https://www.thestreet.com/technology/palo-alto-networks-panw-ai-cybersecurity-strategy) 8. [CyberSecurityNews, "Hackers Are Breaking Into FortiGate, FortiWeb and Palo Alto GlobalProtect Systems to Steal Passwords", 22 October 2026](https://cybersecuritynews.com/breaking-into-fortigate-fortiweb/) --- Palo Alto Networks has no PAN-OS fix for PHP2Shell, calls it 9.2 and sells a paid virtual patch — The Inference. Canonical: https://theinference.org/article/palo-alto-networks-has-no-pan-os-fix-for-php2shell-calls-it-9-2-and-sells-a-paid-virtual-patch