* [Blog](https://www2.paloaltonetworks.com/blog) * [Cloud Security](https://www2.paloaltonetworks.com/blog/cloud-security/) * [AppSec](https://www2.paloaltonetworks.com/blog/cloud-security/category/appsec/) * How Cortex Cloud Protects... # How Cortex Cloud Protects Against PHP2Shell Vulnerabilities From Code to Cloud [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fhow-cortex-cloud-protects-against-php2shell-vulnerabilities-from-code-to-cloud%2F) [](https://twitter.com/share?text=How+Cortex+Cloud+Protects+Against+PHP2Shell+Vulnerabilities+From+Code+to+Cloud&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fhow-cortex-cloud-protects-against-php2shell-vulnerabilities-from-code-to-cloud%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fhow-cortex-cloud-protects-against-php2shell-vulnerabilities-from-code-to-cloud%2F&title=How+Cortex+Cloud+Protects+Against+PHP2Shell+Vulnerabilities+From+Code+to+Cloud&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www2.paloaltonetworks.com/blog/cloud-security/how-cortex-cloud-protects-against-php2shell-vulnerabilities-from-code-to-cloud/&ts=markdown) \[\](mailto:?subject=How Cortex Cloud Protects Against PHP2Shell Vulnerabilities From Code to Cloud) Link copied By [Cameron Hyde](https://www.paloaltonetworks.com/blog/author/cameron-hyde/?ts=markdown "Posts by Cameron Hyde") and [Asaf Henig](https://www.paloaltonetworks.com/blog/author/asaf-henig/?ts=markdown "Posts by Asaf Henig") Oct 22, 2026 8 minutes [AppSec](https://www.paloaltonetworks.com/blog/cloud-security/category/appsec/?ts=markdown) [Cloud Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security/?ts=markdown) [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown) [Software Supply Chain Security](https://www.paloaltonetworks.com/blog/cloud-security/category/software-supply-chain-security/?ts=markdown) [Vulnerability Management](https://www.paloaltonetworks.com/blog/cloud-security/category/vulnerability-management/?ts=markdown) **tl;dr** Two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS v4.0 score of 9.2 and could allow unauthenticated remote code execution (RCE). Palo Alto Networks Cortex Attack Surface Management telemetry identified more than 22.6 million internet-exposed instances potentially vulnerable. With proof-of-concept exploits already observed, organizations should immediately upgrade to patched PHP versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35. [Read the full Unit 42 Threat Brief for technical details and recommended protections.](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/) Below, we break down what happened and explore how Cortex delivers out-of-the-box visibility and multilayered protection to identify vulnerable PHP installations, detect post-exploitation activity and help block exploitation attempts. ## What Happened? On October 20, 2026, details of two critical vulnerabilities in PHP core surfaced publicly ahead of their scheduled disclosure. The PHP security team responded with an emergency release on October 21, addressing vulnerabilities that could allow attackers to execute arbitrary code remotely without authentication. The vulnerabilities, collectively referred to as PHP2Shell, stem from flaws in PHP's memory management and request handling: * [**CVE-2026-109618**](https://nvd.nist.gov/vuln/detail/CVE-2026-109618?utm_source=chatgpt.com)**(RCE via out-of-memory corruption):** Improper handling of out-of-memory conditions can leave request data partially initialized, potentially allowing attackers to execute arbitrary code. * [**CVE-2026-109619**](https://nvd.nist.gov/vuln/detail/CVE-2026-109619?utm_source=chatgpt.com)**(RCE via stale global state):** Improper memory cleanup can leave references to freed memory, allowing subsequent requests to access stale data and potentially execute arbitrary code. Unlike vulnerabilities in application frameworks or third-party dependencies, these flaws exist in PHP itself. Attackers do not necessarily need to exploit a vulnerability in the application running on top of PHP. In Apache deployments using mod\_php, unauthenticated RCE has been demonstrated before application code even begins executing. The scale of potential exposure is significant. Cortex Xpanse identified more than 22.6 million exposed instances potentially vulnerable to these CVEs. Given PHP's widespread adoption across web applications, content management systems and enterprise infrastructure, many organizations may have vulnerable installations they are not actively tracking. As highlighted in[Millions of PHP Instances Exposed: What Organizations Need To Do Right Now](https://www.paloaltonetworks.com/blog/2026/10/millions-of-php-instances-exposed-what-organizations-need-to-do-right-now/), the accelerating pace of vulnerability discovery and exploitation makes traditional patching cycles increasingly difficult to sustain. Organizations need continuous exposure assessment, proactive risk prevention and real-time protection to reduce their attack surface before threats can be exploited. ## Who Is Affected? The vulnerabilities affect PHP installations serving web requests, including PHP-FPM, Apache with mod\_php, php-cgi, FrankenPHP and LiteSpeed. Specific exploit conditions may vary by deployment. Organizations should assess exposure across: * **Web applications:** PHP-based applications, including WordPress, Drupal, WooCommerce and Adobe Commerce. * **Container images:** Images containing vulnerable PHP versions, including those already deployed in production. * **CI/CD pipelines:** Build processes that introduce vulnerable PHP runtimes into application images. * **Legacy infrastructure:** Servers running PHP 8.1 or older, which no longer receive regular security updates from the PHP project. Organizations using unsupported PHP versions should check for vendor-provided security backports or migrate to supported versions. ## Immediate Steps for Security Teams Organizations should prioritize patching while implementing additional security controls to reduce exposure and prevent exploitation. | **Priority** | **Recommended Action** | | Immediate | **Identify vulnerable PHP installations** across repositories, container images, cloud workloads and servers. Prioritize internet-facing assets. | | Immediate | **Upgrade PHP** to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply verified vendor backports. Restart affected PHP workers. | | Immediate | **Enable threat prevention protections** to block known exploitation attempts while patching is underway. | | High | **Rebuild and redeploy affected container images** and enforce pipeline policies to prevent vulnerable versions from reaching production. | | High | **Investigate potential compromise** by reviewing suspicious PHP processes, unexpected shell execution, newly created PHP files and abnormal worker crashes. | | High | **Apply temporary mitigations** when patching is not immediately possible and isolate unsupported installations until they can be remediated. | |--------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------| For organizations unable to patch immediately, the[official PHP security advisories](https://github.com/php/php-src/security/advisories) outline configuration-based mitigations. These measures can reduce exposure to specific attack paths but do not eliminate the vulnerabilities. Updating remains the only complete solution. ## How Cortex Cloud Helps Protect Against PHP2Shell Responding to PHP2Shell requires more than identifying vulnerable PHP installations. Security teams need to understand which assets are exposed, prioritize remediation based on risk and prevent vulnerable software from reaching production. ### Introducing the PHP2Shell Security Advisor To help customers quickly assess their exposure, Palo Alto Networks is introducing the PHP2Shell Security Advisor, a custom Cortex AgentiX agent designed to identify and prioritize risks associated with CVE-2026-109618 and CVE-2026-109619. The agent searches across virtual machines, VM images, container workloads, container images and serverless functions to identify vulnerable assets. It provides a clear exposure assessment and prioritizes affected assets based on business criticality and risk. Beyond identifying vulnerabilities, the agent checks whether affected assets have Cortex XDR agent protection and whether existing vulnerability policies have flagged the CVEs. It then recommends prioritized remediation actions and preventive guardrails across CI/CD pipelines and admission controls. The agent operates in read-only mode, giving security teams actionable recommendations while maintaining full control over remediation and policy changes in the Cortex console. Beyond this targeted assessment, Cortex Cloud connects application security, vulnerability management and runtime protection to help organizations continuously identify and prioritize risk, prevent known vulnerabilities from reaching production and protect applications already running in the cloud. | **Where** | **Cortex Capability** | **How It Helps** | | Code \& Repositories | Supply Chain Attacks Portal | Tracks PHP2Shell, identifies vulnerable PHP versions and helps security teams understand which assets are affected. | | CI/CD Pipelines | Cortex CLI \& Pipeline Enforcement | Scans container images for vulnerabilities and enforces policies to block affected builds before they reach production. | | Cloud \& Container Images | Cortex Cloud Vulnerability Management | Detects vulnerable PHP versions across code, cloud environments and container images to help teams identify exposure and prioritize remediation. | | Attack Surface | Cortex Xpanse | Discovers internet-exposed PHP installations and alerts security teams through the PHP Attack Surface Rule. | | Servers \& Endpoints | Cortex XDR | Provides software inventory capabilities for supported endpoints and multilayered protection against post-exploitation activity. | | Cloud Runtime | Cortex Cloud Runtime \& Cortex XSIAM | Helps detect and respond to post-exploitation activity through multilayered security protections. | | Network | NGFW with Advanced Threat Prevention Plus | Helps block exploitation attempts through Frontier Virtual Patching, including Threat ID **543004**, available since October 20, 2026. | |---------------------------|-------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------| ### Prevent PHP2Shell from Reaching Production PHP2Shell can be tracked through the Cortex Cloud Supply Chain Attacks Portal, giving security teams a centralized view of the threat, affected software versions and potential exposure across their environments. By connecting supply chain threat intelligence with code-to-cloud visibility, Cortex Cloud helps organizations identify vulnerable components and determine which applications need attention. Security teams can then enforce preventive policies through Cortex Cloud and its CI/CD integrations. With Cortex CLI, organizations can scan newly built container images for the affected CVEs and block builds that violate their vulnerability policies, preventing vulnerable PHP versions from reaching production. ### Prioritize and Protect Vulnerable Workloads Identifying vulnerable software in code is only part of the challenge. Organizations also need to understand where affected versions are already deployed and which assets face the greatest risk. For workloads already running in production, Cortex Cloud Runtime, Cortex XDR and Cortex XSIAM provide multilayered protection against post-exploitation activity. Cortex Attack Surface Management helps identify exposed PHP installations that may otherwise go unnoticed, while Frontier Virtual Patching provides additional network-level protection against known exploitation attempts. Cortex Exposure Management along with detections provided by Cortex Cloud, Cortex XDR and Cortex Network Scanner help to detect and prioritize vulnerable assets, including those that are on-prem or not exposed to the Internet. The precision filtering engine helps to reduce the alert fatigue and focus on what matters the most for the next steps. Together, these capabilities help organizations move beyond reactive vulnerability management to continuously identify, prioritize and prevent risk from code to runtime. ## Beyond Patching: Preventing the Next Supply Chain Threat PHP2Shell demonstrates how vulnerabilities in widely used software can create risk across millions of internet-facing systems. Patching vulnerable PHP installations is the immediate priority, but organizations also need a sustainable approach to identifying and preventing these risks across their environments. By connecting application security, vulnerability management and runtime protection, Cortex Cloud helps organizations continuously identify, prioritize and remediate risk from code to cloud, while preventing known vulnerabilities from reaching production. ## Learn More Protect your applications from emerging software supply chain threats with Cortex Cloud. Unify application security, vulnerability management and runtime protection to identify and prioritize risk, prevent vulnerable software from reaching production and continuously reduce risk from code to cloud. [Request a Demo](https://www.paloaltonetworks.com/cortex/cloud) to see how Cortex Cloud can help secure your applications and software supply chain. ## Additional Resources * [Unit 42 Threat Brief: Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/) * [Millions of PHP Instances Exposed: What Organizations Need To Do Right Now](https://www.paloaltonetworks.com/blog/2026/10/millions-of-php-instances-exposed-what-organizations-need-to-do-right-now/) * [CVE-2026-109618: RCE via Out-of-Memory Corruption](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) * [CVE-2026-109619: RCE via Stale Global State](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) *** ** * ** *** ## Related Blogs ### [AppSec](https://www.paloaltonetworks.com/blog/cloud-security/category/appsec/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [Software Supply Chain Security](https://www.paloaltonetworks.com/blog/cloud-security/category/software-supply-chain-security/?ts=markdown) [#### Are We Exposed? Turning Threat Intelligence Into Action with the Supply Chain Attacks Portal](https://www2.paloaltonetworks.com/blog/cloud-security/turning-threat-intelligence-into-action-with-supply-chain-attacks-portal/) ### [Announcement](https://www.paloaltonetworks.com/blog/cloud-security/category/announcement/?ts=markdown), [AppSec](https://www.paloaltonetworks.com/blog/cloud-security/category/appsec/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [Code to Cloud](https://www.paloaltonetworks.com/blog/cloud-security/category/code-to-cloud/?ts=markdown), [Software Supply Chain Security](https://www.paloaltonetworks.com/blog/cloud-security/category/software-supply-chain-security/?ts=markdown) [#### Cortex Cloud Named an Overall Leader in KuppingerCole's 2026 Software Supply Chain Security Report](https://www2.paloaltonetworks.com/blog/cloud-security/kuppingercole-supply-chain-report-leadership/) ### [AppSec](https://www.paloaltonetworks.com/blog/cloud-security/category/appsec/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [Software Supply Chain Security](https://www.paloaltonetworks.com/blog/cloud-security/category/software-supply-chain-security/?ts=markdown) [#### Build Trust into the SDLC with Cortex Cloud's Software Supply Chain Security](https://www2.paloaltonetworks.com/blog/cloud-security/software-supply-chain-security-module-new/) ### [AppSec](https://www.paloaltonetworks.com/blog/cloud-security/category/appsec/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [Software Supply Chain Security](https://www.paloaltonetworks.com/blog/cloud-security/category/software-supply-chain-security/?ts=markdown) [#### Shift Left Has Never Made Sense](https://www2.paloaltonetworks.com/blog/cloud-security/shift-left-vs-unifying-appsec-cloudsec-runtime/) ### [AI-SPM](https://www.paloaltonetworks.com/blog/cloud-security/category/ai-spm/?ts=markdown), [Application Security](https://www.paloaltonetworks.com/blog/cloud-security/category/application-security/?ts=markdown), [AppSec](https://www.paloaltonetworks.com/blog/cloud-security/category/appsec/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [Software Supply Chain Security](https://www.paloaltonetworks.com/blog/cloud-security/category/software-supply-chain-security/?ts=markdown) [#### Why Are Software Supply Chains Under Constant Siege?](https://www2.paloaltonetworks.com/blog/cloud-security/software-supply-chain-security-ai-risks-attacks-defense/) ### [AppSec](https://www.paloaltonetworks.com/blog/cloud-security/category/appsec/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security/?ts=markdown), [Software Composition Analysis](https://www.paloaltonetworks.com/blog/cloud-security/category/software-composition-analysis/?ts=markdown) [#### Securing Open-Source Software in the Frontier AI Era](https://www2.paloaltonetworks.com/blog/cloud-security/securing-open-source-software-in-the-frontier-ai-era/) ### Subscribe to Cloud Security Blogs! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www2.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * Observability * [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language