Palo Alto releases first PAN-OS hotfixes for exploited PHP flaws
- Affected
- PAN-OS
10.2through12.2on firewalls and Panorama before the hotfixes, and three Cisco products before their fixes. All versions and fixes
- CVE
- Vendor
- PHP
Palo Alto Networks has released the first PAN-OS hotfixes for the PHP flaws known as PHP2Shell, which Amazon says attackers are broadly trying to exploit. Seven of the 20 were out by Oct 26, and Palo Alto dates the rest from Oct 27 to Oct 30. Its advisory says the flaws affect PAN-OS on firewalls and on Panorama. Palo Alto knows of no attacks on its products.
Only PAN-OS’s management web interface is affected, including the XML API, and a dataplane interface only when it has a management profile attached. Palo Alto scores the risk 8.7, with only availability at stake, when the interface can be reached from the internet, and 7.1 when only a jump box can reach it. GlobalProtect portals and gateways and the captive portal aren’t affected.
Until a hotfix is installed, Palo Alto now lists 25 Threat IDs for Threat Prevention subscribers, in content versions 9162, 9163, 9164 and later. They protect the management interface only when its traffic is routed through a dataplane port, decrypted and inspected. Restricting management access to trusted internal addresses minimizes the risk, Palo Alto says.
Palo Alto has corrected its advisory to list WildFire WF-500 and WF-500-B appliances as not affected. It says a third PHP flaw, which the PHP team disclosed on Oct 23, doesn’t affect PAN-OS, because it needs a configuration PAN-OS doesn’t use.
Cisco updated its own advisory on Oct 23 to say workarounds exist for Expressway and Ultra-Reliable Wireless Backhaul, described in each product’s bug entry. Their fixes are still 15.5.21 with no date and 27.1.1 in February 2027. Cisco also lists Duo Access Gateway as affected, fixed in 3.2.0.
- CVE
- Vendor
- PHP
What to do
5 steps
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| PAN-OS 12.2 | Releases before 12.2.4-h1 | 12.2.4-h1, due Oct 28 |
| PAN-OS 12.1 | Releases before the hotfixes | 12.1.7-h11 due Oct 28, 12.1.4-h13 due Oct 29, 12.1.10-h3 due Oct 30 |
| PAN-OS 11.2 | Releases before the hotfixes | 11.2.10-h16 released, 11.2.13-h4 due Oct 27, 11.2.16-h1 due Oct 28, 11.2.7-h23 due Oct 29, 11.2.4-h23 due Oct 30 |
| PAN-OS 11.1 | Releases before the hotfixes | 11.1.4-h38, 11.1.6-h40, 11.1.10-h36, 11.1.13-h16 and 11.1.16-h4 released, 11.1.7-h12 due Oct 30 |
| PAN-OS 10.2 | Releases before the hotfixes | 10.2.18-h13 released, 10.2.13-h27 due Oct 27, 10.2.16-h12 due Oct 28, 10.2.10-h42 due Oct 29, 10.2.7-h39 due Oct 30 |
| WildFire WF-500 and WF-500-B | Not affected | No action needed |
| Cisco Expressway and Expressway Select | Listed as vulnerable | 15.5.21, no date yet, with a workaround in CSCwx37062 |
| Cisco Ultra-Reliable Wireless Backhaul | Listed as vulnerable | 27.1.1, due February 2027, with a workaround in CSCwx37073 |
| Cisco Duo Access Gateway | Listed as vulnerable | 3.2.0 |
- Product
- PAN-OS 12.2
- Affected
- Releases before
12.2.4-h1 - Fixed
12.2.4-h1, due Oct 28
- Product
- PAN-OS 12.1
- Affected
- Releases before the hotfixes
- Fixed
12.1.7-h11due Oct 28,12.1.4-h13due Oct 29,12.1.10-h3due Oct 30
- Product
- PAN-OS 11.2
- Affected
- Releases before the hotfixes
- Fixed
11.2.10-h16released,11.2.13-h4due Oct 27,11.2.16-h1due Oct 28,11.2.7-h23due Oct 29,11.2.4-h23due Oct 30
- Product
- PAN-OS 11.1
- Affected
- Releases before the hotfixes
- Fixed
11.1.4-h38,11.1.6-h40,11.1.10-h36,11.1.13-h16and11.1.16-h4released,11.1.7-h12due Oct 30
- Product
- PAN-OS 10.2
- Affected
- Releases before the hotfixes
- Fixed
10.2.18-h13released,10.2.13-h27due Oct 27,10.2.16-h12due Oct 28,10.2.10-h42due Oct 29,10.2.7-h39due Oct 30
- Product
- WildFire WF-500 and WF-500-B
- Affected
- Not affected
- Fixed
- No action needed
- Product
- Cisco Expressway and Expressway Select
- Affected
- Listed as vulnerable
- Fixed
15.5.21, no date yet, with a workaround in CSCwx37062
- Product
- Cisco Ultra-Reliable Wireless Backhaul
- Affected
- Listed as vulnerable
- Fixed
27.1.1, due February 2027, with a workaround in CSCwx37073
- Product
- Cisco Duo Access Gateway
- Affected
- Listed as vulnerable
- Fixed
3.2.0
Timeline
- Oct 21Palo Alto publishes its advisory on the PHP flaws.
- Oct 23Palo Alto adds hotfix dates for PAN-OS and lists WildFire WF-500 appliances as not affected.
- Oct 24Palo Alto adds Threat IDs and the content versions that carry them.
- Oct 25Palo Alto lists
10.2.18-h13,11.1.16-h4and11.2.10-h16as released. - Oct 26Palo Alto lists four more PAN-OS
11.1hotfixes as released.
Sources
- Palo Alto Networks advisoryPrimary source security.paloaltonetworks.com
- Cisco advisoryPrimary source sec.cloudapps.cisco.com
- Amazon researchPrimary source aws.amazon.com
- Canadian Centre for Cyber Security advisoryPrimary source cyber.gc.ca