Guiding Customers Through Critical PHP Vulnerabilities

Over the past week, our industry has faced a wave of critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). As Palo Alto Networks Chief Technology and Product Officer Lee Klarichhighlighted, these high-severity vulnerability disclosures are just the beginning of a massive acceleration of cyberthreats that will define the foreseeable future.

Because PHP powers more than half of the web, relying on traditional patch cycles is no longer viable: while enterprise patchingaverages 55 days, threat actors can move from breach to data exfiltration in as little as 39 seconds.

With AI delivering a step-change in attack speed and depth, organizations simply cannot wait for patch development and deployment. They need proactive discovery and pre-emptive protection provided by Frontier Virtual Patching before the vulnerabilities are disclosed.

When vulnerabilities of this magnitude emerge, enterprise customers turn immediately to their trusted advisors for clarity and direction. Palo Alto Networks partners play a pivotal role in guiding customers through this shift, moving them from reactive patching scrambles toward long-term protection. This resilience lands on one foundational imperative: Frontier Virtual Patching(FVP)must be enforced across all outbound traffic, not just at endpoints, in the cloud, or across Web Application Firewalls (WAFs).

The next few months will be a critical moment for partners to step in front of customers to educate them on the modern exposure gap, help them understand their true reachability, and rapidly protect their environments before weaponized exploits land.

With AI agents and frontier models available at the fingertips of any adversary, exploitation windows are collapsing.Nearly 30% of vulnerabilitiesare now weaponized by threat actors within 24 hours of disclosure. In the case of #PHP2Shell and #Brotli, telemetry revealed autonomous agents actively probing and compromising exposed entities within just 2 to 4 hours.

Customers must understand the uniqueseverity of these threats:

The hardest part of defending against vulnerabilities is tracking them down. Organizations must gain immediate, complete visibility into their true attack surface.

Through our Frontier AI Alliance, we’ve engaged leading global systems integrators and service providers to deliver this protection at enterprise scale, already helping partners assess and secure hundreds of customer environments to date.

Over the past week, Palo Alto Networks has mobilized proactive services and intelligence tools to help partners guide customers through exposure discovery. Through Cortex Xpanse, defenders have mapped internet-facing assets to pinpoint exposed PHP footprints globally, while Unit 42 Continuous Frontier AI Defense provides reachability analysis to distinguish between theoretical software flaws and weaponizable attack paths.

While discovering exposure is critical, customers cannot wait until their inventory is perfect to defend themselves.

Customers running Frontier Virtual Patching on Palo Alto Networks Advanced Threat Prevention (ATP) Plus were protected before the PHP vulnerabilities were even made public.

Fueled by ourNetwork and Open-Source Vulnerability Analyzer (NOVA), our frontier AI vulnerability analyzer, our customers have been shielded from these PHP exploits since October 20, without any downtime, software restarts, or manual policy changes. Because this protection runs at the network layer, it shields every workload whose traffic passes through the firewall, including the ones that aren't in their inventory yet.

Let's urge our customers to stop treating virtual patching as an emergency measure and start treating it as a foundational layer of their architecture. Our team is here to help you -learn more.

By submitting this form, you agree to ourTerms of Useand acknowledge ourPrivacy Statement. Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder.

By submitting this form, you agree to ourTerms of Useand acknowledge ourPrivacy Statement.

By submitting this form, I understand my personal data will be processed in accordance withPalo Alto Networks Privacy StatementandTerms of Use.

Copyright © 2026 Palo Alto Networks. All Rights Reserved