Nomios Threat Intelligence update: Firewall patch status

What has happened

Fixes are arriving before the attacks

In the past two weeks every major firewall vendor has released urgent fixes, and several have shortened their usual timelines. In most cases the vendor says it is not aware of exploitation. They are moving early anyway, for three reasons.

• AI is finding flaws in bulk. Fortinet says its 22 October release fixes critical and high-severity flaws uncovered with frontier AI testing. Cisco says its 21 October Snort 3 hardening release came from internal testing that included frontier AI models, and it now groups such findings into hardening releases published twice a month on a fixed schedule.
• The gap between patch and exploit is shrinking. Fortinet is withholding CVE details until 10 November because AI tools can help attackers compare patched and unpatched code and build a working exploit in hours or days rather than weeks.
• Details are escaping early. Details of PHP2Shell, two critical flaws in the PHP engine, leaked on 20 October ahead of coordinated disclosure. PHP shipped its fix a day early, and firewall vendors that build PHP into their management or portal interfaces followed within days.

What the world is seeing

PHP2Shell reaches firewalls

PHP is built into the web interfaces of several firewall platforms, so PHP2Shell reaches devices that most people would not think of as web servers.

No exploitation of these firewall issues. None of the five vendors reports malicious exploitation of the issues in this bulletin. Palo Alto says it is not aware of exploitation of PHP2Shell against its products and Cisco says its October release is not known to be exploited. No exploitation has been reported for Fortinet's release or Juniper's October bulletins.

Palo Alto is warning of activity. This week Palo Alto Networks told customers it is aware of "heightened threat actor activity targeting internet exposed management interfaces" of PAN-OS firewalls and Panorama, and urged them to apply its management access best practices immediately.

PHP2Shell is being attempted at scale. Check Point Research reports exploitation attempts against 10 per cent of organisations worldwide since the leak, rising to 14 per cent in Europe, 12 per cent in the UK and 15 per cent in the Netherlands. It says attack traffic grew from thousands to millions of attempts after disclosure, and Zscaler ThreatLabz saw attempts within 48 hours. These are attempts, not confirmed compromises.

Most public exploit code does not work yet. VulnCheck, reviewing dozens of public PHP2Shell proofs of concept, says very few use the right mechanism and none defeats memory randomisation on x86-64 systems on its own. However, working exploits are in use: CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalogue on 26 October, confirming exploitation in the wild. Expect noisy logs, where a flood of attempts says little about whether a given device is at risk, but do not dismiss them.

Exploits tend to follow disclosure. Fortinet is scheduled to publish its details on 10 November and Cisco's next disclosure window is 4 November, though vendors have been moving dates at short notice. Earlier this year attackers exploited firewall flaws after they were disclosed, including Cisco's ASA and FTD remote access VPN flaw (CVE-2026-20349) in August, two Firewall Management Center flaws fixed in Cisco's September hardening release, and Check Point's Security Management flaw CVE-2026-93616, added to CISA's Known Exploited Vulnerabilities catalogue on 22 September.

Severity ratings differ. PHP rates PHP2Shell 9.2 (CVSS v4.0). Palo Alto rates its own exposure High at 8.7, falling to 7.1 when management access is limited to a jump host. The difference reflects how exposed the interface is, not doubt about the flaw.

Dates to plan around

These are the dates vendors have stated. They are liable to change: vendors have been moving dates at short notice in both directions. Check Point brought its fix forward by almost three weeks, while Palo Alto's 11.2.13-h4 hotfix, estimated for 27 October, had not been released by 28 October. Check your vendor's advisory before planning work around them.

Fortinet

At a glance

What has changed

On 21 October Fortinet announced a security hardening release for FortiOS, FortiManager and FortiAnalyzer, published on 22 October after earlier updates for FortiMail and FortiAuthenticator. It fixes critical and high-severity flaws, and Fortinet asks customers to treat it as a priority change rather than routine maintenance.

Fortinet is holding back CVE identifiers, scores and per-issue detail until its Patch Tuesday, currently scheduled for 10 November, so attackers cannot use the advisories to reverse-engineer the fixes. Once the details are public, expect exploit development to follow quickly, so aim to finish upgrading before then.

What to do

1. Run get system status on every FortiGate, including each HA member, and note the FortiOS version.
2. Upgrade to the fixed release for your branch using Fortinet's upgrade path tool. Fortinet's usual order is FortiAnalyzer, then FortiManager, then FortiGates. FortiManager and FortiAnalyzer fixed releases are in Fortinet's announcement; FortiManager Cloud may need a manual update.
3. 3 Until upgraded, make sure HTTPS and SSH administrative access is not enabled on internet-facing interfaces, and restrict administrators with trusted hosts. If a FortiGate runs a branch not listed, contact us before planning the upgrade.

Cisco

At a glance

What has changed

Snort 3 is the inspection engine in FTD and Meraki MX. Cisco groups the flaws under CVE-2026-20043,-20236, -20291 and -20356; the worst are rated 9.0. There are no workarounds.

Meraki MX appliances online in Dashboard were updated automatically by 21 October. Snort 3 UTD on IOS XE routers also needs fixed images.

What to do

1. Upgrade FTD to the first fixed release for your train. Upgrade the Firewall Management Center first if needed: it must run the same or a later version than the devices it manages.
2. Confirm every Meraki MX is online and reporting to Dashboard.
3. Subscribe to Cisco Security Notifications for advance notice of the next disclosure window, currently scheduled for 4 November.

Palo Alto Networks

At a glance

What has changed

The flaw is reached through the management web interface (the HTTPS web UI and XML API) and through any data-plane interface with a management profile attached. Palo Alto rates its exposure High (CVSS-B 8.7), falling to 7.1 when management access is limited to a jump host. Its risk is highest when management can be reached from the internet.

This week Palo Alto emailed customers warning of "heightened threat actor activity targeting internet exposed management interfaces" and urged them to apply its management interface best practices immediately.

Node2Shell: Palo Alto says the same hotfixes also fix the Brotli flaw in Node.js covered in our Node2Shell bulletin of 26 October. The exception is 11.2.10-h16, which fixes PHP2Shell only; 11.2.10-h17 includes both fixes.

What to do

1. Restrict management access now. Allow the HTTPS web UI and XML API only from trusted internal addresses or a jump host, and remove management profiles from internet-facing data-plane interfaces, following Palo Alto's best practice guide.
2. Upgrade to the hotfix for your train (table on the next page) as soon as it is released, or to a later released hotfix on the same major version. Upgrade Panorama too; it must run the same or a later version than the firewalls it manages.
3. Threat Prevention customers: enable Threat ID 543004 and the related IDs in the advisory (content version 9162 or later). They only protect management traffic that is routed through a data-plane interface, decrypted and inspected, so they do not replace restricting access. Advanced Threat Prevention Plus customers on 12.2.4 or later received coverage on 20 October.
4. Review management logs for administrator logins and configuration changes from unexpected addresses since 20 October.

ETAs are Palo Alto's estimates and liable to change; the 11.2.13-h4 date has already passed. Where your hotfix is still pending, the advisory also lists a later release on the same major version (for example 11.1.16-h4 or 10.2.18-h13, both released). Older, unsupported versions must move to a supported fixed version.

Check Point

At a glance

What has changed

Check Point pushed an automatic mitigation through Automatic Updates by 22 October, released a hotfix in CPUSE on 23 October, and added a built-in IPS signature that protects R82.20 even with the IPS blade off. The hotfix needs a reboot; there is no Live Patch.

HPE Juniper Networking

At a glance

What has changed

The most important October fixes for SRX are below. Fixed releases differ by issue and train, so check each bulletin.

What to do

1. Disable J-Web if unused ( delete system services web-management ); otherwise allow it only from trusted management hosts, never on untrust zones.
2. Run show version on every SRX, including both chassis cluster nodes, and upgrade to a release that fixes the October issues for your train.
3. J-Web runs on PHP and its PHP2Shell status was still listed as under investigation at the last public update. Treat it as potentially exposed until Juniper's status advisory confirms otherwise.