What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers

What happened

On 22 October 2026, Palo Alto Networks confirmed that all versions of its PAN-OS firewall operating system and Panorama management platform are affected by vulnerabilities known as PHP2Shell ^[1]. The flaws allow an attacker to execute code on the system remotely, without authenticating, which means without needing a username or password.

The company said no patches or workarounds are available yet, and that it will release updates "as soon as possible" ^[1]. Fortinet is investigating 12 products and Cisco 31 products and cloud services for the same vulnerabilities, though neither has confirmed affected products so far ^[1].

The vulnerabilities are in PHP-CGI, a component used by web servers to run PHP scripts. When it's misconfigured, an attacker can send a crafted request that gets executed as code.

Why it matters

Firewalls and network management systems sit at the edge of an organisation's defences. A vulnerability that lets an attacker in without a password is about as serious as it gets. It's like finding out the lock on your front door opens if you just ask it nicely.

For customers running affected systems, the question now is what to do while waiting for patches. For the manufacturers, the question is what they knew and when they reported it.

The 24-hour rule

The Cyber Resilience Act has applied since 11 September 2026 to manufacturers of products with digital elements ^[2]. Article 14 requires them to report actively exploited vulnerabilities and serious incidents through ENISA's common platform, in stages with short deadlines. The early warning goes out within 24 hours of becoming aware of the issue ^[2].

That clock starts when the manufacturer becomes aware, not when it suits them. It's the same principle as when you lose your bank card: the timer starts when you notice it's gone, not when you've had time to check your statement.

The rule doesn't say the manufacturer must have a fix ready within a day, just that it must tell the authorities. The point is to give other organisations time to react, for instance by blocking certain traffic or isolating systems, before an exploit spreads.

What this means for you

If you run Palo Alto firewalls or Panorama:

• Check Palo Alto's security advisories daily until patches are released.
• Consider whether you can restrict access to the management interface from untrusted networks.
• Make sure you have a recent backup of configurations, in case systems need to be rebuilt.
• Document when you first became aware of the issue and what steps you took. If something happens, that timeline matters.

If you run Fortinet or Cisco products on the investigation lists:

• Watch for updates from the manufacturers.
• If you have products that use PHP-CGI, check whether they are exposed to untrusted networks.

If you sell or support any of these products:

• Your customers will ask what they should do. Have an answer ready, and keep it updated as the manufacturers release more information.
• If a customer suffers an incident involving one of these vulnerabilities, the question of when you told them about it will come up.

The incident log

When an incident happens, or when you take steps to prevent one, a log of what you did and when becomes part of the evidence. An attacker who gets in through an unpatched vulnerability will leave traces, but so will your own response: when you restricted access, when you applied a patch, when you told customers.

Logs kept by the people who could change them are easy to challenge later. An auditor or a supervisor asking what you knew on a given day wants a record that stands up, not one you could have quietly edited.

Here, the thing to seal is each detection note, each decision to escalate and each report as it is sent. Sealing takes a fingerprint, not the content, so the notes themselves never leave your systems. If you're asked a year later why the early warning went out after 30 hours instead of 24, anyone you share the record with can check that the one you show is the one written at the time.

A digital witness per event gives you your own record, unchanged. It doesn't show that the response was adequate or that the report was complete, but it does show when each step was recorded, in a way nobody can quietly rewrite afterwards.

You can seal log segments as they are written, through the REST API, the SDK or the MCP server. WitniumChain is one way to do it. The content stays with you, and the first 2,000 witnesses a month are free. Read the docs for how to get started.

How it would work

1. Your monitoring system detects the vulnerability and writes a detection note. You seal the note at that moment.
2. The security team decides to escalate and sends an early warning. You seal a copy of the report as it is sent.
3. Patches arrive two days later. You seal the deployment log.

Months later, if someone asks when you knew and what you did, you have a checkable record of each step.

What to watch

Palo Alto has said patches are coming. Until then, check their advisories daily. Fortinet and Cisco's investigations may yet turn up affected products, so if you run any of the products on their lists, keep an eye on their security pages.

Under the Cyber Resilience Act, fines for failing to report can reach 15 million euro or 2.5 per cent of global annual turnover ^[2]. The rule is new, but the principle is old: when something serious happens, the authorities want to know quickly.

For anyone running network infrastructure, the question is no longer whether vulnerabilities will turn up, but what you do when they do. The organisations that come out of incidents well are the ones that can show what they knew, when they knew it and what they did about it.

A log that holds up is a start.