Today, the PHP project disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in the scripting language behind a large share of the world's web servers and content management systems. Both are rated 9.2 under Common Vulnerability Scoring System (CVSS 4.0). Both can be exploited by an unauthenticated attacker.
For most organizations, the question isn't whether they run PHP. It's where they run it, and how much of it they can patch before attackers arrive. That is the frontier AI exposure gap, playing out in real time. Customers running Frontier Virtual Patching on Palo Alto Networks® Advanced Threat Prevention Plus didn't have to wait for it to close. They've been protected since October 20, before the vulnerability details were public.
Why this one matters
Four details make this a top-priority event for every security team:
- No credentials required. According to the PHP security advisory, every PHP installation serving web requests is at risk. Risk is highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs.
- Massive exposure. Cortex Xpanse has identified more than 22 million exposed instances potentially vulnerable to these flaws.
- Exploit code already exists. Unit 42 has seen proof-of-concept exploits, and many European governments have taken their websites offline as a precaution.
- No safe workaround. The PHP security team is clear that interim configuration changes reduce exposure but do not make a server safe. Updating is the only complete fix.
The exposure gap has moved to your side of the ledger
When we introduced Frontier Virtual Patching with PAN-OS 12.2, we described total exposure of 145+ days as the sum of two delays: the time it takes a vendor to release a patch (30-90 days), and the time it takes a customer to deploy it (~ 55 days).
In this case, the PHP security team did exactly what good maintainers should. They gave advance notice, coordinated with Linux distributions, and released fixed versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35) on the day of disclosure. Vendor time-to-release patch was effectively zero.
That leaves the second half of the equation, and it is the harder one. The average enterprise takes 55 days to remediate an application vulnerability. Meanwhile, 29% of vulnerabilities are now weaponized within 24 hours of disclosure. And PHP is rarely a single server you can update on schedule. It runs inside content management systems, container images, internal tools and third-party appliances whose software you don't control. PHP 8.1 and older no longer receive fixes from the PHP project at all.
You can't patch what you can't find, and no organization will find and patch every PHP instance this week. Patching faster is necessary. But, it is no longer sufficient for the vulnerability deluge we are seeing in the frontier AI era.
This is exactly the scenario Frontier Virtual Patching was built for.
Protection even before disclosure
Customers running Advanced Threat Prevention Plus with Frontier Virtual Patching have been protected against CVE-2026-109618 and CVE-2026-109619 since October 20, before the vulnerability details were made public, through Threat Prevention signature 543004. No downtime. No software restarts. No manual policy changes. After publication of the vulnerability and patches, Advanced Threat Prevention has also released standard IPS coverage (via signatures 543004, 97622, 97623, 97624, 97625) on Oct 21st. After the regular content release for ATP, signature 543004 will be in both Frontier Virtual Patching and ATP content for a 7-day grace period, after which it will be retired from Frontier Virtual Patching preemptive coverage.
Because that protection runs at the network layer, it shields every PHP workload whose traffic passes through the firewall, including the ones that aren't in your inventory yet. It extends across PA-Series, VM-Series and soon Prisma Access, so the same protection applies in the data center, the cloud and containerized environments. Here are the details of the pre-emptive coverage shown in Strata Cloud Manager.
This is what preemptive defense looks like in practice. Frontier Virtual Patching combines proactive vulnerability discovery from NOVA, our frontier AI vulnerability analyzer (has scanned 6000+ OSS repositories in 3 months and found 17000+ vulnerabilities of which 99% are novel and 40% are critical), with early disclosures from partners in our Critical Defense Program and more than 20 traditional intelligence sources. Vaulted protection lets us deliver pre-emptive virtual patching before a vulnerability is public, without revealing the details an attacker would need to build an exploit.
Actions for network security leaders today
For network security leaders, addressing the PHP vulnerabilities starts with these practical actions.
- First, shield every PHP workload now. To mitigate and ensure attack protections, confirm that your security policies apply Advanced Threat Prevention Plus to traffic headed to both internet-facing and internal PHP servers, and that the signature is set to block. For HTTPS applications, make sure inbound traffic is decrypted so the firewall can see the exploit attempt.
- Second, assess your inventory - find every PHP instance, including the ones you don't know about. Enable the PHP Attack Surface Rule in Cortex Xpanse to surface internet-exposed PHP. Use Cortex Cloud Posture or Prisma Cloud Compute to find vulnerable PHP versions in code and cloud workloads.
- Third, patch in priority order based on reachability. Prioritize patching public-facing and high-risk servers first by updating to supported, secure software versions or applying distribution patches. If immediate updates aren't possible, request vendor timelines, migrate off legacy systems, and apply interim hardening measures to mitigate risk.
- Fourth, assume someone may have gotten there first. Deploy real time security operations; use Cortex XDR or Cortex XSIAM to hunt for post-exploitation activity on PHP hosts. If you suspect a compromise, engage the Unit 42 Incident Response team.
- Fifth, make preemptive protection the default. This won't be the last critical vulnerability in software that runs everywhere. Treat virtual patching as a standing layer of your architecture, not an emergency measure.
These actions help security leaders move from reacting to each disclosure to staying ahead of it. Patching remains the ultimate cure. But the organizations that come through events like this one unscathed won't simply be the ones that patch fastest. They'll be the ones that were protected with Frontier Virtual Patching before they had to.
Take the next step
- Get started with a 30-day Frontier Virtual Patching trial.
- Read the Unit 42 Threat Brief on CVE-2026-109618 and CVE-2026-109619.
- Review the PHP security advisory and update guidance.
- Learn how Frontier Virtual Patching works and watch the deep dive.
- Under attack? Contact Unit 42.