[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/ "High Profile Threats") * [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/ "Vulnerabilities") [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/) # Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25) ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 7 min read Related Products [![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex Cloud](https://unit42.paloaltonetworks.com/product-category/cortex-cloud/ "Cortex Cloud")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex Xpanse icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex Xpanse](https://unit42.paloaltonetworks.com/product-category/cortex-xpanse/ "Cortex Xpanse")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Prisma Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Prisma Cloud](https://unit42.paloaltonetworks.com/product-category/prisma-cloud/ "Prisma Cloud")[![Prisma Cloud Compute icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Prisma Cloud Compute](https://unit42.paloaltonetworks.com/product-category/prisma-cloud-compute/ "Prisma Cloud Compute")[![Unit 42 Deep and Dark Web Service icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Deep and Dark Web Service](https://unit42.paloaltonetworks.com/product-category/unit-42-deep-dark-web/ "Unit 42 Deep and Dark Web Service")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response")[![Unit 42 Threat Intelligence Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Threat Intelligence Services](https://unit42.paloaltonetworks.com/product-category/unit-42-threat-intel-services/ "Unit 42 Threat Intelligence Services") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Unit 42](https://unit42.paloaltonetworks.com/author/unit42/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:October 23, 2026 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) * [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [CVE-2026-109618](https://unit42.paloaltonetworks.com/tag/cve-2026-109618/) * [CVE-2026-109619](https://unit42.paloaltonetworks.com/tag/cve-2026-109619/) * [PHP2Shell](https://unit42.paloaltonetworks.com/tag/php2shell/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/?pdf=download&lg=en&_wpnonce=cff02088b3 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/?pdf=print&lg=en&_wpnonce=cff02088b3 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)]( "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fcve-2026-109618-cve-2026-109619%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)]( "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)]( "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fcve-2026-109618-cve-2026-109619%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)]( "Share in Mastodon") ## Executive Summary ### October 25 Update Unit 42 reported earlier that we had observed post-compromise activity that we initially thought was related to the PHP2Shell vulnerabilities. What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application. This led us to believe that it was exploitation of those vulnerabilities. We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs. We have retracted our previous update from October 23. *** ** * ** *** Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619, referred to as PHP2Shell. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0). We encourage reviewing the [PHP Group's security advisory and patching guidance](https://www.php.net/index.php). PHP is widely used across web servers and content management systems globally. We recommend assessing your exposure to these vulnerabilities and patching immediately. Palo Alto Networks has evaluated our product portfolio regarding this issue. Refer to our [security advisory](https://security.paloaltonetworks.com/CVE-2026-109618) for the most up to date details. * [CVE-2026-109618](https://nvd.nist.gov/vuln/detail/cve-2026-109618) involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers. * [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/cve-2026-109619) describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code. At the time of publication, Palo Alto Networks [Cortex Xpanse](https://docs-cortex.paloaltonetworks.com/p/XPANSE) has identified the presence of over 22.6 million exposed instances potentially vulnerable to CVE-2026-109618 and CVE-2026-109619 based on our telemetry. Palo Alto Networks customers receive protections from and mitigations for CVE-2026-109618 and CVE-2026-109619 in the following ways: * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) * [Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-docs) and [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [Cortex Xpanse](https://docs-cortex.paloaltonetworks.com/p/XPANSE) * [Advanced Threat Prevention Plus with Frontier Virtual Patching](https://www.paloaltonetworks.com/blog/network-security/harnessing-ai-for-prevention-introducing-frontier-virtual-patching/) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) Palo Alto Networks also recommends assessing your exposure to these vulnerabilities and patching immediately. Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through[Unit 42 Threat Intel Services](https://www.paloaltonetworks.com/unit42/threat-intelligence) and our[Deep and Dark Web Service](https://www.paloaltonetworks.com/resources/datasheets/unit-42-deep-and-dark-web-service). The [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk. |-------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Vulnerabilities Discussed** | [**CVE-2026-109618**](https://unit42.paloaltonetworks.com/tag/CVE-2026-109618/), [**CVE-2026-109619**](https://unit42.paloaltonetworks.com/tag/CVE-2026-109619/), **[PHP2Shell](https://unit42.paloaltonetworks.com/tag/PHP2Shell)** | ## Unit 42 Managed Threat Hunting Queries The Unit 42 Managed Threat Hunting team continues to track any attempts to exploit these CVEs across our customers, using Cortex XDR and the XQL queries below. Cortex XDR customers can also use these XQL queries to search for signs of exploitation. // Description: This query attempts to identify post-exploitation command execution within the context of a PHP web server or worker process. // Notes: This hunting query is not specific to CVE-2026-109618 and CVE-2026-109619. It is capable of identifying exploitation of various web application vulnerabilities. This query may also produce false positive findings depending on the specific web applications running. We recommend validating if any identified activity is expected for the web applications running on systems. config case\_sensitive = false | dataset = xdr\_data | filter event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START and action\_process\_image\_name != null | fields _time, agent\_hostname, agent\_id, event\_id, actor\_effective\_username, actor\_process\_image\_name, actor\_process\_command\_line, action\_process\_image\_name, action\_process\_image\_path, action\_process\_image\_command\_line, causality\_actor\_process\_image\_name, causality\_actor\_process\_command\_line // Lowercase fields once | alter actor\_effective\_username = lowercase(actor\_effective\_username), actor\_process\_image\_name = lowercase(actor\_process\_image\_name), actor\_process\_command\_line = lowercase(actor\_process\_command\_line), action\_process\_image\_name = lowercase(action\_process\_image\_name), action\_process\_image\_path = lowercase(action\_process\_image\_path), action\_process\_image\_command\_line = lowercase(action\_process\_image\_command\_line), causality\_actor\_process\_image\_name = lowercase(causality\_actor\_process\_image\_name) // Anchor: PHP web worker (or the launcher that started it) as causality, PHP worker as direct parent, // a shell directly under an IIS worker, or the web service account outside an interactive login session | filter causality\_actor\_process\_image\_name ~= "^(?:apache2|httpd|apachectl|php-fpm\[0-9.\]\*|php-cgi\[0-9.\]\*(?:\\.cagefs)?|php-fcgi|sw-engine(?:-fpm)?|frankenphp|lsphp\[0-9\]\*|lshttpd|litespeed|xampp-control|wampmanager|laragon|de\\.appsolute\\.mampprohelper)(?:\\.exe)?$" or actor\_process\_image\_name ~= "^(?:apache2|httpd|php-fpm\[0-9.\]\*|php-cgi\[0-9.\]\*(?:\\.cagefs)?|php-fcgi|sw-engine(?:-fpm)?|frankenphp|lsphp\[0-9\]\*|lshttpd|litespeed)(?:\\.exe)?$" or (causality\_actor\_process\_image\_name = "w3wp.exe" and actor\_process\_image\_name in ("cmd.exe", "powershell.exe", "pwsh.exe")) or (actor\_effective\_username ~= "(?:^|\[^a-z0-9_-\])(?:www-data|apache|nginx|wwwrun|iusr)$" and coalesce(causality\_actor\_process\_image\_name, "") !~= "^(?:sshd(?:-session)?|screen|tmux|login|mosh-server|dropbear)$") or actor\_effective\_username contains "iis apppool" // Known-benign workloads (monitoring plugins, hosting control panels) and commands launched directly by CDK Drive DMS scripts | filter action\_process\_image\_command\_line !~= "(?:\\/usr\\/lib(?:64)?\\/nagios\\/plugins\\/|\\/usr\\/local\\/cpanel\\/|\\/usr\\/local\\/psa\\/|\\/opt\\/psa\\/|\\/usr\\/local\\/directadmin\\/|\\/usr\\/local\\/ispconfig\\/|\\/usr\\/local\\/virtualizor\\/|richdocumentscode|phpsysinfo|librenms|zabbix)" and coalesce(actor\_process\_command\_line, "") !~= "^(?:\\S+\\s+)?(?:\\/adp\\/(?:bin|3party|etc)\\/|\\/local\\/bin\\/uminfo)" // Phusion Passenger app spawns run id/uname/env from their spawn helpers | filter coalesce(action\_process\_image\_command\_line, "") !~= "^(?:\\/usr\\/bin\\/)?(?:id(?:\\s+-\[a-z\]+)?|uname(?:\\s+-\[a-z\]+)?|hostname|env)$|passenger-config\\s+system-metrics" or lowercase(coalesce(actor\_process\_command\_line, "")) !~= "passengeragent\\s+spawn-|spawn(?:preparer|envsetupper)shell|\\/helper-scripts\\/rack-preloader\\.rb|passenger\_ruby\_wrapper|phusion\_passenger" // RHEL-family /etc/profile runs these in every bash login shell | filter coalesce(action\_process\_image\_command\_line, "") !~= "^\\/usr\\/bin\\/(?:id\\s+-\[ug\]n|hostname)$" or lowercase(coalesce(actor\_process\_command\_line, "")) !~= "^(?:\\S\*\\/)?bash\\s+-\[a-z\]\*l|^-bash$" // parsed\_lookup: the tool is the first command of its parent "sh -c" and its output is piped into a text filter (scripted lookup) | alter tool = replace(action\_process\_image\_name, ".exe", ""), shell\_first\_cmd = arrayindex(regextract(coalesce(actor\_process\_command\_line, ""), "^-?(?:\\S\*\\/)?(?:ba|da|k)?sh\\s+-c\\s+(\\S+)"), 0) | alter parsed\_lookup = if(arrayindex(regextract(coalesce(shell\_first\_cmd, ""), "(\[^\\/\]+)$"), 0) = tool and actor\_process\_command\_line ~= "^-?(?:\\S\*\\/)?(?:ba|da|k)?sh\\s+-c\\s+\[^;\&|\]+\\|\\s\*(?:e?grep|awk|cut|sed|wc|head|tail|sort|tr)\\b", 1, 0) // Signals - one event can carry several | alter signals = concat( // SCORED - host/user/network/container recon, excluding scripted lookups (distinct tools are counted later) if(parsed\_lookup = 0 and (tool in ("whoami", "hostname", "hostnamectl", "ifconfig", "netstat", "ss", "arp", "route", "w", "who", "last", "lastlog", "getent", "lsb\_release", "lscpu", "printenv", "env", "getcap", "capsh", "systeminfo", "ipconfig", "nltest", "tasklist", "quser", "qwinsta") or (tool = "uname" and action\_process\_image\_command\_line ~= "\\buname\\s+(?:-\[a-z\]\*\[arv\]|--all|--kernel-)") or (tool = "id" and action\_process\_image\_command\_line !~= "\\bid\\s+-\[ugnrz\]+\\b") or (tool = "ip" and action\_process\_image\_command\_line ~= "\\bip\\s+(?:-\[a-z0-9\]+\\s+)\*(?:a|addr|address|r|route|n|neigh|link)\\b") or (tool = "ps" and action\_process\_image\_command\_line ~= "\\bps\\s+(?:-?aux|-ef|-e\\b|axjf|-auxf)") or (tool in ("net", "net1") and action\_process\_image\_command\_line ~= "\\bnet1?(?:\\.exe)?\\s+(?:user|group|localgroup|accounts|view|share)\\b") or (tool = "cat" and action\_process\_image\_command\_line ~= "\\/etc\\/(?:passwd|shadow|group|issue|os-release|hosts|hostname|resolv\\.conf|crontab|sudoers)|\\/proc\\/(?:version|net\\/|(?:self|\[0-9\]+)\\/(?:cgroup|mountinfo))|\\/\\.dockerenv") or (tool = "find" and action\_process\_image\_command\_line ~= "-perm\\s+(?:-4000|-u=s|\\/4000|-2000)") or (tool = "sudo" and action\_process\_image\_command\_line ~= "\\bsudo\\s+-l\\b")), "recon,", ""), // SCORED - payload transfer to a file (curl with an output file, wget not to stdout), excluding /dev/null and localhost if(((tool = "curl" and action\_process\_image\_command\_line ~= "\\s(?:-\[a-z\]\*o\\b|--output\\b|--remote-name)|\>\\s\*\\S") or (tool = "wget" and action\_process\_image\_command\_line !~= "\\s-\[a-z\]\*o\\s\*-(?:\\s|$)|--output-document=-|--spider") or (tool in ("tftp", "fetch") and action\_process\_image\_command\_line ~= "(?:https?|ftp|tftp):\\/\\/|\\s-\[a-z\]\*o(?:\\s|-|$)") or (tool = "certutil" and action\_process\_image\_command\_line ~= "urlcache|verifyctl") or (tool = "bitsadmin" and action\_process\_image\_command\_line contains "/transfer") or (tool in ("powershell", "pwsh") and action\_process\_image\_command\_line ~= "downloadstring|downloadfile|invoke-webrequest|\\biwr\\b|net\\.webclient|start-bitstransfer")) and action\_process\_image\_command\_line !~= "-o\\s\*\\/dev\\/null|--output-document=\\/dev\\/null|:\\/\\/(?:localhost|127\\.0\\.0\\.1|\\\[::1\\\])?\[:\\/\]", "download,", ""), // SCORED - chmod making a file in a tmp-class directory executable if(tool = "chmod" and action\_process\_image\_command\_line ~= "\\bchmod\\s+(?:-\[a-z\]+\\s+)\*(?:\[0-7\]?(?:\[1357\]\[0-7\]{2}|\[0-7\]\[1357\]\[0-7\]|\[0-7\]{2}\[1357\])|\[ugoa,+=rwst-\]\*\[+=\]\[rwst\]\*x\[ugoa,+=rwxst-\]\*)\\s" and action\_process\_image\_command\_line ~= "\\s\\/(?:tmp|var\\/tmp|dev\\/shm|run\\/shm)\\/", "staging,", ""), // STANDALONE - binary executed from a writable/memory-backed dir, or from a deleted/memfd image if(action\_process\_image\_path ~= "^\\/(?:tmp|var\\/tmp|dev\\/shm|run\\/shm|run\\/user)\\/|^\\/proc\\/(?:self|\[0-9\]+)\\/fd\\/|^\\/memfd:|\\(deleted\\)\\s\*$", "writable\_exec,", ""), // STANDALONE - reverse/bind shell constructs if(action\_process\_image\_command\_line ~= "\\/dev\\/(?:tcp|udp)\\/|(?:^|\[\\s;\&|(\\/\])(?:nc|ncat|netcat)(?:\\.\[a-z\]+)?\\s+(?:\\S+\\s+){0,6}?(?:-\[a-z\]{0,3}\[ec\]|--exec|--sh-exec)\\s+\\S\*(?:sh|bash|cmd|python\[0-9.\]\*|perl)\\b|\\bsocat\\b\[^;\&|\]{0,80}exec:|\\bmkfifo\\b|\\b(?:ba|da|z|a)?sh\\s+-i\\b|socket\\.socket\\(|fsockopen\\(|\\bpty\\.spawn\\(", "revshell,", ""), // STANDALONE - remote content piped straight into an interpreter if(action\_process\_image\_command\_line ~= "(?:curl|wget|fetch)\\b\[^|\]\*\\|\\s\*(?:\\/\\S\*\\/)?(?:(?:ba|da|z|a)?sh|python\[23\]?|perl|php)\\b", "pipe\_to\_shell,", ""), // SCORED - encoded/obfuscated execution if(action\_process\_image\_command\_line ~= "base64\\s+(?:-d|--decode)|frombase64string|-e(?:nc|ncodedcommand)?\\s+\[a-z0-9+\\/\]{40,}|echo\\s+\[a-z0-9+\\/\]{40,}|\\bopenssl\\s+(?:enc\\b\[^|;\]\*\\s-d\\b|base64\\s+-d\\b)|\\bxxd\\s+(?:-\[a-z\]+\\s+)\*-\[a-z\]\*r", "encoded,", ""), // SCORED - persistence / backgrounding (crontab edits, authorized\_keys writes, new users, nohup/setsid of tmp-class binaries or shells, // scheduled tasks, Run keys, systemd units, chattr +i) if((tool = "crontab" and action\_process\_image\_command\_line !~= "\\bcrontab\\s+-l\\s\*$") or (action\_process\_image\_command\_line ~= "(?:\>\>?\\s\*|\\btee\\s+(?:-a\\s+)?|\\b(?:cp|mv|install|ln)\\s+(?:-\\S+\\s+)\*\\S+\\s+)\\S\*authorized\_keys" and action\_process\_image\_command\_line !~= "\\bcp\\s+\\S\*\\/\\.ssh\\/id\_\[a-z0-9\]+\\.pub\\s+\\S\*\\/\\.ssh\\/authorized\_keys") or action\_process\_image\_command\_line ~= "\\b(?:useradd|adduser)\\b|\\b(?:nohup|setsid)\\s+(?:-\\S+\\s+)\*(?:\\.\\/|\\/(?:tmp|var\\/tmp|dev\\/shm|run\\/shm)\\/|(?:ba|da|z)?sh\\s+-\[ci\]\\b)|schtasks\\s+\\/create|currentversion.run\\b|\\bsystemctl\\s+(?:--user\\s+)?enable\\b|\\.config\\/systemd\\/user\\/|\\/etc\\/systemd\\/system\\/|\\bchattr\\s+\\+\[a-z\]\*i", "persistence,", ""), // SCORED - inline interpreter one-liners, excluding PHP version/feature probes and Ruby gem-path probes if(action\_process\_image\_command\_line ~= "(?:^|\[^a-z0-9.\_-\])(?:python\[23\]?(?:\\.\[0-9\]+)?\\s+-c|perl\\s+-e|ruby\\s+-e|node(?:js)?\\s+-e|lua\\s+-e|php\[0-9.\]\*\\s+-r)\\b" and action\_process\_image\_command\_line !~= "phpversion\\(|php\_version|date\\('t'\\)|function\_exists\\(|extension\_loaded\\(|gem\\.path", "interpreter,", ""), // SCORED - cloud/container credential and secret access (credential files, env-var names, instance metadata service, .env reads) if(action\_process\_image\_command\_line ~= "\\.aws\\/(?:credentials|config)|aws\_secret\_access\_key|aws\_session\_token|\\/\\.azure\\/|azure\_client\_secret|identity\_endpoint|\\/\\.config\\/gcloud\\/|application\_default\_credentials\\.json|\\/secrets\\/kubernetes\\.io\\/serviceaccount|\\/run\\/secrets\\/|\\/\\.docker\\/config\\.json|169\\.254\\.169\\.254|metadata\\.google\\.internal|\\/proc\\/(?:self|\[0-9\]+)\\/environ|\\b(?:cat|head|tail|less|more|strings|grep)\\b\[^|;\]\*\\.env\\b", "cred\_access,", "") ) | filter signals != "" | alter recon\_tool = if(signals contains "recon", tool, null) // Group per host, PHP worker and account in 1-hour buckets | bin \_time span = 1h | comp count() as events, count\_distinct(recon\_tool) as recon\_tool\_count, values(recon\_tool) as recon\_tools, values(signals) as signals, values(action\_process\_image\_command\_line) as action\_process\_image\_command\_line, values(actor\_process\_command\_line) as actor\_process\_command\_line, values(causality\_actor\_process\_command\_line) as causality\_actor\_process\_command\_line, first(event\_id) as event\_id by \_time, agent\_id, agent\_hostname, causality\_actor\_process\_image\_name, actor\_effective\_username | alter all\_signals = arraystring(signals, ",") // Threshold: any standalone signal, OR 3+ distinct recon tools, OR recon plus a follow-on scored signal | filter all\_signals ~= "revshell|pipe\_to\_shell|writable\_exec" or recon\_tool\_count \>= 3 or (recon\_tool\_count \>= 1 and all\_signals ~= "download|staging|encoded|persistence|interpreter|cred\_access") |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 | // Description: This query attempts to identify post-exploitation command execution within the context of a PHP web server or worker process. // Notes: This hunting query is not specific to CVE-2026-109618 and CVE-2026-109619. It is capable of identifying exploitation of various web application vulnerabilities. This query may also produce false positive findings depending on the specific web applications running. We recommend validating if any identified activity is expected for the web applications running on systems. config case\_sensitive = false | dataset = xdr\_data | filter event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START and action\_process\_image\_name != null | fields _time, agent\_hostname, agent\_id, event\_id, actor\_effective\_username, actor\_process\_image\_name, actor\_process\_command\_line, action\_process\_image\_name, action\_process\_image\_path, action\_process\_image\_command\_line, causality\_actor\_process\_image\_name, causality\_actor\_process\_command\_line // Lowercase fields once | alter actor\_effective\_username = lowercase(actor\_effective\_username), actor\_process\_image\_name = lowercase(actor\_process\_image\_name), actor\_process\_command\_line = lowercase(actor\_process\_command\_line), action\_process\_image\_name = lowercase(action\_process\_image\_name), action\_process\_image\_path = lowercase(action\_process\_image\_path), action\_process\_image\_command\_line = lowercase(action\_process\_image\_command\_line), causality\_actor\_process\_image\_name = lowercase(causality\_actor\_process\_image\_name) // Anchor: PHP web worker (or the launcher that started it) as causality, PHP worker as direct parent, // a shell directly under an IIS worker, or the web service account outside an interactive login session | filter causality\_actor\_process\_image\_name ~= "^(?:apache2|httpd|apachectl|php-fpm\[0-9.\]\*|php-cgi\[0-9.\]\*(?:\\.cagefs)?|php-fcgi|sw-engine(?:-fpm)?|frankenphp|lsphp\[0-9\]\*|lshttpd|litespeed|xampp-control|wampmanager|laragon|de\\.appsolute\\.mampprohelper)(?:\\.exe)?$" or actor\_process\_image\_name ~= "^(?:apache2|httpd|php-fpm\[0-9.\]\*|php-cgi\[0-9.\]\*(?:\\.cagefs)?|php-fcgi|sw-engine(?:-fpm)?|frankenphp|lsphp\[0-9\]\*|lshttpd|litespeed)(?:\\.exe)?$" or (causality\_actor\_process\_image\_name = "w3wp.exe" and actor\_process\_image\_name in ("cmd.exe", "powershell.exe", "pwsh.exe")) or (actor\_effective\_username ~= "(?:^|\[^a-z0-9_-\])(?:www-data|apache|nginx|wwwrun|iusr)$" and coalesce(causality\_actor\_process\_image\_name, "") !~= "^(?:sshd(?:-session)?|screen|tmux|login|mosh-server|dropbear)$") or actor\_effective\_username contains "iis apppool" // Known-benign workloads (monitoring plugins, hosting control panels) and commands launched directly by CDK Drive DMS scripts | filter action\_process\_image\_command\_line !~= "(?:\\/usr\\/lib(?:64)?\\/nagios\\/plugins\\/|\\/usr\\/local\\/cpanel\\/|\\/usr\\/local\\/psa\\/|\\/opt\\/psa\\/|\\/usr\\/local\\/directadmin\\/|\\/usr\\/local\\/ispconfig\\/|\\/usr\\/local\\/virtualizor\\/|richdocumentscode|phpsysinfo|librenms|zabbix)" and coalesce(actor\_process\_command\_line, "") !~= "^(?:\\S+\\s+)?(?:\\/adp\\/(?:bin|3party|etc)\\/|\\/local\\/bin\\/uminfo)" // Phusion Passenger app spawns run id/uname/env from their spawn helpers | filter coalesce(action\_process\_image\_command\_line, "") !~= "^(?:\\/usr\\/bin\\/)?(?:id(?:\\s+-\[a-z\]+)?|uname(?:\\s+-\[a-z\]+)?|hostname|env)$|passenger-config\\s+system-metrics" or lowercase(coalesce(actor\_process\_command\_line, "")) !~= "passengeragent\\s+spawn-|spawn(?:preparer|envsetupper)shell|\\/helper-scripts\\/rack-preloader\\.rb|passenger\_ruby\_wrapper|phusion\_passenger" // RHEL-family /etc/profile runs these in every bash login shell | filter coalesce(action\_process\_image\_command\_line, "") !~= "^\\/usr\\/bin\\/(?:id\\s+-\[ug\]n|hostname)$" or lowercase(coalesce(actor\_process\_command\_line, "")) !~= "^(?:\\S\*\\/)?bash\\s+-\[a-z\]\*l|^-bash$" // parsed\_lookup: the tool is the first command of its parent "sh -c" and its output is piped into a text filter (scripted lookup) | alter tool = replace(action\_process\_image\_name, ".exe", ""), shell\_first\_cmd = arrayindex(regextract(coalesce(actor\_process\_command\_line, ""), "^-?(?:\\S\*\\/)?(?:ba|da|k)?sh\\s+-c\\s+(\\S+)"), 0) | alter parsed\_lookup = if(arrayindex(regextract(coalesce(shell\_first\_cmd, ""), "(\[^\\/\]+)$"), 0) = tool and actor\_process\_command\_line ~= "^-?(?:\\S\*\\/)?(?:ba|da|k)?sh\\s+-c\\s+\[^;\&|\]+\\|\\s\*(?:e?grep|awk|cut|sed|wc|head|tail|sort|tr)\\b", 1, 0) // Signals - one event can carry several | alter signals = concat( // SCORED - host/user/network/container recon, excluding scripted lookups (distinct tools are counted later) if(parsed\_lookup = 0 and (tool in ("whoami", "hostname", "hostnamectl", "ifconfig", "netstat", "ss", "arp", "route", "w", "who", "last", "lastlog", "getent", "lsb\_release", "lscpu", "printenv", "env", "getcap", "capsh", "systeminfo", "ipconfig", "nltest", "tasklist", "quser", "qwinsta") or (tool = "uname" and action\_process\_image\_command\_line ~= "\\buname\\s+(?:-\[a-z\]\*\[arv\]|--all|--kernel-)") or (tool = "id" and action\_process\_image\_command\_line !~= "\\bid\\s+-\[ugnrz\]+\\b") or (tool = "ip" and action\_process\_image\_command\_line ~= "\\bip\\s+(?:-\[a-z0-9\]+\\s+)\*(?:a|addr|address|r|route|n|neigh|link)\\b") or (tool = "ps" and action\_process\_image\_command\_line ~= "\\bps\\s+(?:-?aux|-ef|-e\\b|axjf|-auxf)") or (tool in ("net", "net1") and action\_process\_image\_command\_line ~= "\\bnet1?(?:\\.exe)?\\s+(?:user|group|localgroup|accounts|view|share)\\b") or (tool = "cat" and action\_process\_image\_command\_line ~= "\\/etc\\/(?:passwd|shadow|group|issue|os-release|hosts|hostname|resolv\\.conf|crontab|sudoers)|\\/proc\\/(?:version|net\\/|(?:self|\[0-9\]+)\\/(?:cgroup|mountinfo))|\\/\\.dockerenv") or (tool = "find" and action\_process\_image\_command\_line ~= "-perm\\s+(?:-4000|-u=s|\\/4000|-2000)") or (tool = "sudo" and action\_process\_image\_command\_line ~= "\\bsudo\\s+-l\\b")), "recon,", ""), // SCORED - payload transfer to a file (curl with an output file, wget not to stdout), excluding /dev/null and localhost if(((tool = "curl" and action\_process\_image\_command\_line ~= "\\s(?:-\[a-z\]\*o\\b|--output\\b|--remote-name)|\>\\s\*\\S") or (tool = "wget" and action\_process\_image\_command\_line !~= "\\s-\[a-z\]\*o\\s\*-(?:\\s|$)|--output-document=-|--spider") or (tool in ("tftp", "fetch") and action\_process\_image\_command\_line ~= "(?:https?|ftp|tftp):\\/\\/|\\s-\[a-z\]\*o(?:\\s|-|$)") or (tool = "certutil" and action\_process\_image\_command\_line ~= "urlcache|verifyctl") or (tool = "bitsadmin" and action\_process\_image\_command\_line contains "/transfer") or (tool in ("powershell", "pwsh") and action\_process\_image\_command\_line ~= "downloadstring|downloadfile|invoke-webrequest|\\biwr\\b|net\\.webclient|start-bitstransfer")) and action\_process\_image\_command\_line !~= "-o\\s\*\\/dev\\/null|--output-document=\\/dev\\/null|:\\/\\/(?:localhost|127\\.0\\.0\\.1|\\\[::1\\\])?\[:\\/\]", "download,", ""), // SCORED - chmod making a file in a tmp-class directory executable if(tool = "chmod" and action\_process\_image\_command\_line ~= "\\bchmod\\s+(?:-\[a-z\]+\\s+)\*(?:\[0-7\]?(?:\[1357\]\[0-7\]{2}|\[0-7\]\[1357\]\[0-7\]|\[0-7\]{2}\[1357\])|\[ugoa,+=rwst-\]\*\[+=\]\[rwst\]\*x\[ugoa,+=rwxst-\]\*)\\s" and action\_process\_image\_command\_line ~= "\\s\\/(?:tmp|var\\/tmp|dev\\/shm|run\\/shm)\\/", "staging,", ""), // STANDALONE - binary executed from a writable/memory-backed dir, or from a deleted/memfd image if(action\_process\_image\_path ~= "^\\/(?:tmp|var\\/tmp|dev\\/shm|run\\/shm|run\\/user)\\/|^\\/proc\\/(?:self|\[0-9\]+)\\/fd\\/|^\\/memfd:|\\(deleted\\)\\s\*$", "writable\_exec,", ""), // STANDALONE - reverse/bind shell constructs if(action\_process\_image\_command\_line ~= "\\/dev\\/(?:tcp|udp)\\/|(?:^|\[\\s;\&|(\\/\])(?:nc|ncat|netcat)(?:\\.\[a-z\]+)?\\s+(?:\\S+\\s+){0,6}?(?:-\[a-z\]{0,3}\[ec\]|--exec|--sh-exec)\\s+\\S\*(?:sh|bash|cmd|python\[0-9.\]\*|perl)\\b|\\bsocat\\b\[^;\&|\]{0,80}exec:|\\bmkfifo\\b|\\b(?:ba|da|z|a)?sh\\s+-i\\b|socket\\.socket\\(|fsockopen\\(|\\bpty\\.spawn\\(", "revshell,", ""), // STANDALONE - remote content piped straight into an interpreter if(action\_process\_image\_command\_line ~= "(?:curl|wget|fetch)\\b\[^|\]\*\\|\\s\*(?:\\/\\S\*\\/)?(?:(?:ba|da|z|a)?sh|python\[23\]?|perl|php)\\b", "pipe\_to\_shell,", ""), // SCORED - encoded/obfuscated execution if(action\_process\_image\_command\_line ~= "base64\\s+(?:-d|--decode)|frombase64string|-e(?:nc|ncodedcommand)?\\s+\[a-z0-9+\\/\]{40,}|echo\\s+\[a-z0-9+\\/\]{40,}|\\bopenssl\\s+(?:enc\\b\[^|;\]\*\\s-d\\b|base64\\s+-d\\b)|\\bxxd\\s+(?:-\[a-z\]+\\s+)\*-\[a-z\]\*r", "encoded,", ""), // SCORED - persistence / backgrounding (crontab edits, authorized\_keys writes, new users, nohup/setsid of tmp-class binaries or shells, // scheduled tasks, Run keys, systemd units, chattr +i) if((tool = "crontab" and action\_process\_image\_command\_line !~= "\\bcrontab\\s+-l\\s\*$") or (action\_process\_image\_command\_line ~= "(?:\>\>?\\s\*|\\btee\\s+(?:-a\\s+)?|\\b(?:cp|mv|install|ln)\\s+(?:-\\S+\\s+)\*\\S+\\s+)\\S\*authorized\_keys" and action\_process\_image\_command\_line !~= "\\bcp\\s+\\S\*\\/\\.ssh\\/id\_\[a-z0-9\]+\\.pub\\s+\\S\*\\/\\.ssh\\/authorized\_keys") or action\_process\_image\_command\_line ~= "\\b(?:useradd|adduser)\\b|\\b(?:nohup|setsid)\\s+(?:-\\S+\\s+)\*(?:\\.\\/|\\/(?:tmp|var\\/tmp|dev\\/shm|run\\/shm)\\/|(?:ba|da|z)?sh\\s+-\[ci\]\\b)|schtasks\\s+\\/create|currentversion.run\\b|\\bsystemctl\\s+(?:--user\\s+)?enable\\b|\\.config\\/systemd\\/user\\/|\\/etc\\/systemd\\/system\\/|\\bchattr\\s+\\+\[a-z\]\*i", "persistence,", ""), // SCORED - inline interpreter one-liners, excluding PHP version/feature probes and Ruby gem-path probes if(action\_process\_image\_command\_line ~= "(?:^|\[^a-z0-9.\_-\])(?:python\[23\]?(?:\\.\[0-9\]+)?\\s+-c|perl\\s+-e|ruby\\s+-e|node(?:js)?\\s+-e|lua\\s+-e|php\[0-9.\]\*\\s+-r)\\b" and action\_process\_image\_command\_line !~= "phpversion\\(|php\_version|date\\('t'\\)|function\_exists\\(|extension\_loaded\\(|gem\\.path", "interpreter,", ""), // SCORED - cloud/container credential and secret access (credential files, env-var names, instance metadata service, .env reads) if(action\_process\_image\_command\_line ~= "\\.aws\\/(?:credentials|config)|aws\_secret\_access\_key|aws\_session\_token|\\/\\.azure\\/|azure\_client\_secret|identity\_endpoint|\\/\\.config\\/gcloud\\/|application\_default\_credentials\\.json|\\/secrets\\/kubernetes\\.io\\/serviceaccount|\\/run\\/secrets\\/|\\/\\.docker\\/config\\.json|169\\.254\\.169\\.254|metadata\\.google\\.internal|\\/proc\\/(?:self|\[0-9\]+)\\/environ|\\b(?:cat|head|tail|less|more|strings|grep)\\b\[^|;\]\*\\.env\\b", "cred\_access,", "") ) | filter signals != "" | alter recon\_tool = if(signals contains "recon", tool, null) // Group per host, PHP worker and account in 1-hour buckets | bin \_time span = 1h | comp count() as events, count\_distinct(recon\_tool) as recon\_tool\_count, values(recon\_tool) as recon\_tools, values(signals) as signals, values(action\_process\_image\_command\_line) as action\_process\_image\_command\_line, values(actor\_process\_command\_line) as actor\_process\_command\_line, values(causality\_actor\_process\_command\_line) as causality\_actor\_process\_command\_line, first(event\_id) as event\_id by \_time, agent\_id, agent\_hostname, causality\_actor\_process\_image\_name, actor\_effective\_username | alter all\_signals = arraystring(signals, ",") // Threshold: any standalone signal, OR 3+ distinct recon tools, OR recon plus a follow-on scored signal | filter all\_signals ~= "revshell|pipe\_to\_shell|writable\_exec" or recon\_tool\_count \>= 3 or (recon\_tool\_count \>= 1 and all\_signals ~= "download|staging|encoded|persistence|interpreter|cred\_access") | // Description: This query identifies potential inbound exploitation attempts from publicly routed IP addresses using Palo Alto Networks NGFW Threat Logs. config case\_sensitive = false | dataset = panw\_ngfw\_threat\_raw | filter sub\_type = "vulnerability" | filter to\_zone !~= "internet|untrust|outside|external|wan" | filter not (incidr(source\_ip, "10.0.0.0/8") or incidr(source\_ip, "172.16.0.0/12") or incidr(source\_ip, "192.168.0.0/16")) | filter to\_string(threat\_id) contains "543004" or threat\_name ~= "php|multipart|upload.progress|longjmp|CVE-2026-10961\[89\]" | comp count() as hits, count\_distinct(source\_ip) as sources, values(source\_ip) as source\_ips, values(action) as actions, values(severity) as severities, min(\_time) as first\_seen, max(\_time) as last\_seen by threat\_name, threat\_id, dest\_ip, nat\_dest, dest\_port, to\_zone | sort desc hits |----------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 | // Description: This query identifies potential inbound exploitation attempts from publicly routed IP addresses using Palo Alto Networks NGFW Threat Logs. config case\_sensitive = false | dataset = panw\_ngfw\_threat\_raw | filter sub\_type = "vulnerability" | filter to\_zone !~= "internet|untrust|outside|external|wan" | filter not (incidr(source\_ip, "10.0.0.0/8") or incidr(source\_ip, "172.16.0.0/12") or incidr(source\_ip, "192.168.0.0/16")) | filter to\_string(threat\_id) contains "543004" or threat\_name ~= "php|multipart|upload.progress|longjmp|CVE-2026-10961\[89\]" | comp count() as hits, count\_distinct(source\_ip) as sources, values(source\_ip) as source\_ips, values(action) as actions, values(severity) as severities, min(\_time) as first\_seen, max(\_time) as last\_seen by threat\_name, threat\_id, dest\_ip, nat\_dest, dest\_port, to\_zone | sort desc hits | ## Palo Alto Networks Product Protections for CVE-2026-109618 and CVE-2026-109619 Palo Alto Networks customers can leverage several product protections and updates to identify and defend against these vulnerabilities. Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through [Unit 42 Threat Intel Services](https://www.paloaltonetworks.com/unit42/threat-intelligence) and its[Deep and Dark Web Service](https://www.paloaltonetworks.com/resources/datasheets/unit-42-deep-and-dark-web-service). If you think you might have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 000 800 050 45107 * South Korea: +82.080.467.8774 ### Cortex XDR and XSIAM [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) help protect against post-exploitation activities using the multi-layer protection approach. provide multilayered protection against post-exploitation activities. Cortex XDR also provides visibility into installed software across endpoints and servers, including on-premises and legacy environments, to help security teams identify systems running vulnerable PHP versions and prioritize remediation. ### Cortex Cloud and Prisma Cloud [Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/vulnerability-management-in-cortex-cloud) and [Prisma Cloud](https://docs.prismacloud.io/) help identify vulnerable PHP versions across code, registry images and runtime instances. Cortex Cloud's Supply Chain Attacks Portal helps teams identify affected assets and take action to prevent vulnerable components from being reintroduced. Additionally, Cortex CLI integrates into CI/CD pipelines to scan images and enforce policies that block vulnerable images before they reach registries and runtime environments. ### Cortex Xpanse [Cortex Xpanse](https://docs-cortex.paloaltonetworks.com/p/XPANSE) can identify exposed devices on the public internet and escalate these findings to defenders. Customers can enable alerting on this risk by ensuring that the PHP Attack Surface Rule is enabled. Identified findings can either be viewed in the Threat Response Center or in the incident view of Expander. These findings are also available for Cortex XSIAM customers who have purchased the ASM module. ### Next-Generation Firewall Next-Generation Firewall with the following security subscriptions can help block the attacks: * [Advanced Threat Prevention Plus with Frontier Virtual Patching](https://www.paloaltonetworks.com/blog/network-security/harnessing-ai-for-prevention-introducing-frontier-virtual-patching/) since 10:21 p.m. PT on October 20, 2026, via Threat ID [543004](https://threatvault.paloaltonetworks.com/?query=543004). * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) with best practices since October 21, 2026 via the following Threat Prevention signatures [543004](https://threatvault.paloaltonetworks.com/?query=543004), [97622](https://threatvault.paloaltonetworks.com/?query=97622), [97623](https://threatvault.paloaltonetworks.com/?query=97623), [97624](https://threatvault.paloaltonetworks.com/?query=97624), and [97625](https://threatvault.paloaltonetworks.com/?query=97625). ## Additional Resources * [Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products](https://security.paloaltonetworks.com/CVE-2026-109618) --- Advisory, Palo Alto Networks * [Millions of PHP Instances Exposed: What Organizations Need To Do Right Now](https://www.paloaltonetworks.com/blog/2026/10/millions-of-php-instances-exposed-what-organizations-need-to-do-right-now/) --- Lee Klarich, Palo Alto Networks * [Security advisory: Critical remote code execution vulnerabilities, update now](https://www.php.net/archive/2026.php#2026-10-21-5) - PHP *Updated October 21, 2026, at 9:30 a.m. PT to add Palo Alto Networks security advisory, update links in additional resources, and update product protection section.* *Updated October 21, 2026, at 1:00 p.m. PT to update the product protection section.* *Updated October 22, 2026, at 4:30 p.m. PT to add additional product protection information for Advanced Threat Prevention, Cortex Cloud, and Prisma Cloud and make light copyedits.* *Updated October 23, 2026, at 12:30 p.m. PT to add details on agentic AI post-exploitation activity and Managed Threat Hunting queries.* *Updated October 25, 2026, at 2:15 p.m. PT to retract our October 23 update.* Back to top ### Tags * [CVE-2026-109618](https://unit42.paloaltonetworks.com/tag/cve-2026-109618/ "CVE-2026-109618") * [CVE-2026-109619](https://unit42.paloaltonetworks.com/tag/cve-2026-109619/ "CVE-2026-109619") * [PHP2Shell](https://unit42.paloaltonetworks.com/tag/php2shell/ "PHP2Shell") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: EMudhra Intermediate CA Certificates Compromised](https://unit42.paloaltonetworks.com/emudhra-certificate-compromise/ "EMudhra Intermediate CA Certificates Compromised") ### Table of Contents * ### Related Articles ## Related Vulnerabilities Resources ![Pictorial representation of PAN-OS CVE-2026-0257. A vibrant city skyline at night, with tall skyscrapers and glowing digital beams extending into the sky, suggesting advanced technology and connectivity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/07_Vulnerabilities_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) October 20, 2026 [#### Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/) * [CVE-2026-0257](https://unit42.paloaltonetworks.com/tag/cve-2026-0257/ "CVE-2026-0257") * [Vulnerability](https://unit42.paloaltonetworks.com/tag/vulnerability/ "vulnerability") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/ "Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)") ![Pictorial representation of NetScaler zero days. Digital illustration of a map of North America with interconnected glowing lines and dots symbolizing network connections across the continent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/06_Vulnerabilities_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) September 30, 2026 [#### Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)](https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/) * [Citrix](https://unit42.paloaltonetworks.com/tag/citrix/ "Citrix") * [CVE-2026-88771](https://unit42.paloaltonetworks.com/tag/cve-2026-88771/ "CVE-2026-88771") * [CVE-2026-88772](https://unit42.paloaltonetworks.com/tag/cve-2026-88772/ "CVE-2026-88772") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ "Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)") ![Pictorial representation of a group of people interacting with a dynamic 3D holographic display of colorful, undulating data waves on a table.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/09/11_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) August 4, 2026 [#### The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI") * [Vulnerability Exploitation](https://unit42.paloaltonetworks.com/tag/vulnerability-exploitation/ "Vulnerability Exploitation") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/ "The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software") ![Pictorial representation of AI-enabled autonomous cyberattacks. A digital illustration depicting abstract, interconnected data streams in vibrant colors on a dark blue background](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/AdobeStock_992950050-3-782x440.jpeg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 30, 2026 [#### Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/) * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") * [CVEs](https://unit42.paloaltonetworks.com/tag/cves/ "CVEs") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ "Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks") ![Pictorial representation of three zero-day vulnerabilities in Siemens ROX II OT switches. Digital illustration of a global network featuring interconnected lines and nodes over a map of the world, highlighted with neon lights and digital elements.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/03_Vulnerabilities_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 17, 2026 [#### Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy](https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/) * [Command injection](https://unit42.paloaltonetworks.com/tag/command-injection/ "Command injection") * [CVE-2025-40947](https://unit42.paloaltonetworks.com/tag/cve-2025-40947/ "CVE-2025-40947") * [CVE-2025-40948](https://unit42.paloaltonetworks.com/tag/cve-2025-40948/ "CVE-2025-40948") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/ "Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy") ![Pictorial representation of CVE-2026-30300. Digital illustration of a map of North America with interconnected glowing lines and dots symbolizing network connections across the continent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/06_Vulnerabilities_1920x900-3-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) May 6, 2026 [#### Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution](https://unit42.paloaltonetworks.com/captive-portal-zero-day/) * [CVE-2026-0300](https://unit42.paloaltonetworks.com/tag/cve-2026-0300/ "CVE-2026-0300") * [EarthWorm](https://unit42.paloaltonetworks.com/tag/earthworm/ "EarthWorm") * [PAN-OS](https://unit42.paloaltonetworks.com/tag/pan-os/ "PAN-OS") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/captive-portal-zero-day/ "Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution") ![Pictorial representation of a severe Linux vulnerability. Close-up of a woman wearing glasses and focusing intently on a computer screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Vulnerabilities_1920x900-2-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) May 5, 2026 [#### Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/) * [Containers](https://unit42.paloaltonetworks.com/tag/containers/ "Containers") * [CVE-2026-31431](https://unit42.paloaltonetworks.com/tag/cve-2026-31431/ "CVE-2026-31431") * [Kubernetes](https://unit42.paloaltonetworks.com/tag/kubernetes/ "Kubernetes") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/ "Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years") ![Pictorial representation of CVE-2023-33538. Abstract image of a glowing red Wi-Fi symbol on a circuit board, with intricate patterns and a futuristic appearance.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/04_Vulnerabilities_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) April 16, 2026 [#### A Deep Dive Into Attempted Exploitation of CVE-2023-33538](https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538/) * [Botnet](https://unit42.paloaltonetworks.com/tag/botnet/ "botnet") * [Command injection](https://unit42.paloaltonetworks.com/tag/command-injection/ "Command injection") * [CVE-2023-33538](https://unit42.paloaltonetworks.com/tag/cve-2023-33538/ "CVE-2023-33538") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538/ "A Deep Dive Into Attempted Exploitation of CVE-2023-33538") ![Pictorial representation of BeyondTrust vulnerability CVE-2026-1731. Digital art depicting a stylized mountain range with vibrant blue and red hues. The peaks are accentuated by glowing particles and an abstract, starry backdrop, creating a futuristic landscape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/14_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) February 19, 2026 [#### VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)](https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/) * [Bash](https://unit42.paloaltonetworks.com/tag/bash/ "bash") * [CVE-2026-1731](https://unit42.paloaltonetworks.com/tag/cve-2026-1731/ "CVE-2026-1731") * [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/ "PowerShell") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/ "VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * Observability * [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center-subscribe.html) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)