22.6M Exposed Instances Potentially Vulnerable Following Critical PHP Disclosure: Palo Alto Networks Unit 42

• 22 Oct 2026
• TM Team
• 0 Comments

Palo Alto Networks Unit 42 is urging organisations to take immediate action following the disclosure of two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, each carrying a CVSS severity score of 9.2.

PHP is a widely used technology that sits behind millions of websites and web applications. The newly disclosed vulnerabilities exploit flaws in how PHP handles information in its memory. Under certain conditions, an attacker could deliberately trigger these flaws and potentially make a vulnerable server run commands of the attacker’s choosing, without first needing to authenticate to the affected system.

As of 21 October 2026, Palo Alto Networks Cortex Xpanse has identified the presence of over 22.6 million exposed instances potentially vulnerable based on telemetry data. This underscores the scale of risk associated with widely deployed open-source software and the growing challenge of defending against cyberthreats in the era of frontier AI.

Unit 42 has also seen proof-of-concept exploitation of these vulnerabilities, demonstrating that they can be practically exploited. At least one European government has taken its website offline as a precaution.

The vulnerabilities represent a significant shift in the cyberthreat landscape, where increasingly capable AI models are accelerating vulnerability discovery while attackers can reverse engineer newly released patches and target underlying flaws at unprecedented speed.

By comparison, recent vulnerabilities in NetScaler affected over 50,000 potentially vulnerable exposed instances, while a BeyondTrust vulnerability (CVE-2026-1731) involved over 16,000 exposed instances. The widespread use of PHP, which powers a substantial proportion of websites globally, creates an exposure footprint on an entirely different scale.

As outlined in Palo Alto Networks' Defender's Guide to the Frontier AI Impact on Cybersecurity, advances in frontier AI are fundamentally changing the speed and scale at which vulnerabilities can be discovered and exploited. Traditional, manual patching cycles alone are no longer sufficient to address this evolving threat landscape.

Five Actions Organisations Should Take Now

Palo Alto Networks recommends five immediate priorities to help organisations strengthen their defenses:

1.    Assess open-source exposure: Organisations must maintain continuous visibility into their software inventory, codebase and supply chain to identify vulnerabilities and potential blind spots. Attack surface management solutions are critical to understanding exposure, while services such as Unit 42 Continuous Frontier AI Defense help defenders proactively discover and remediate vulnerabilities before attackers can weaponise them.

2.    Prioritise remediation based on reachability: With millions of potentially exposed instances, organisations should prioritise vulnerabilities based on their accessibility to attackers and the potential impact of exploitation. Solutions such as Cortex Xpanse and exposure management can help identify reachable assets, assess risk and automate remediation.

3.    Secure AI deployments: As organisations accelerate AI adoption, they must ensure that new AI applications and infrastructure are secured from the outset. Every AI deployment must be a secure AI deployment to avoid introducing additional vulnerabilities into an already expanding attack surface.

4.    Implement proactive virtual patching and attack protections: Organisations should complement traditional software patching with real-time virtual patching to mitigate exploitation while permanent fixes are deployed. Palo Alto Networks' new Frontier Virtual Patching capability delivered preemptive coverage for both PHP vulnerabilities ahead of their public disclosure. Palo Alto Networks customers are also protected against exploitation of these vulnerabilities through Advanced Threat Prevention, available on next-generation firewalls and Prisma Access.

5.    Deploy real-time security operations: As autonomous AI-driven attacks compress attack lifecycles to minutes, security operations centres must evolve to detect and respond at machine speed. Organisations should target single-digit mean time to detect (MTTD) and mean time to respond (MTTR), supported by automation and AI-driven security operations.

Building Continuous, Automated Defenses

The disclosure of these vulnerabilities reinforces the need for organisations to move beyond reactive, point-in-time security measures toward continuous, automated defense.

As frontier AI accelerates vulnerability discovery and compresses the time between patch availability and potential exploitation, organisations must institutionalise proactive vulnerability discovery, exposure assessment, risk-based remediation and real-time attack prevention.

By combining continuous visibility, AI-driven security capabilities and proactive virtual patching, organisations can reduce their exposure, strengthen cyber resilience and help maintain the defender's advantage.