Is Your Firewall’s Management Page Open to the Internet? A Cybersecurity Check for Nebraska and Tampa Bay Businesses.

You’re wrapping up Friday when your IT provider asks a question: “Can someone reach your firewall’s management page from the public internet?” Would you know the answer—or who to ask?

For business owners in Nebraska and Tampa Bay, that is a useful cybersecurity check to put on today’s list. The management page is the control room where an administrator changes firewall settings. It needs a more selective guest list than your company website.

What Unit 42 reported on October 29

In its October 29 threat brief, Palo Alto Networks’ Unit 42 reported active exploitation of two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. The observed attacks targeted PAN-OS management interfaces exposed to the internet. PAN-OS is the software used by certain Palo Alto Networks firewalls and management systems.

PHP is software that helps run web applications, including some administrative pages. A vulnerability is a weakness in software; a CVE number is its tracking label. These two weaknesses can allow remote code execution: an attacker gets the system to run commands they choose.

Unit 42 also described a reported attack chain combining PHP2Shell with a Linux kernel privilege-escalation flaw, and said it independently verified the attacker’s tooling and reported results. In everyday language, attackers combined weaknesses to gain root access—the system’s highest level of control. The kernel is the operating system’s core; privilege escalation means gaining more power than an account or process should have.

The important detail: management access is not public by default

Unit 42 says these management interfaces are not exposed to the internet by default. The reported attacks concern interfaces that had been made publicly reachable. A firewall handling your business’s internet traffic does not automatically mean its administrative controls are open to the world.

The official Palo Alto Networks security advisory identifies affected and fixed versions. It says this issue affects the management web interface, including its browser-based controls and XML API, a way software sends administrative requests. It also says GlobalProtect portals, gateways and Clientless VPN are not impacted by this issue.

That distinction matters. This report does not mean every PAN-OS device is vulnerable, every business using Palo Alto Networks has been compromised, or any Soarin Group customer is affected. Your device, software version and access settings need to be checked. Keeping management access private reduces exposure; an affected version still needs the applicable fix.

Four checks to make with your IT provider

1. Confirm the device and exact software version

Ask your IT provider which firewall and management systems your business uses, who maintains them, and the complete software version installed. Include any Panorama management system. Match those details against the advisory’s product and version tables rather than relying on a brand name or “we updated it recently.”

2. Keep the control room private

Have qualified IT support verify whether management access is reachable from outside your trusted network. If public access is enabled, Unit 42 recommends removing it immediately and restricting management access to trusted internal IP addresses—the network addresses of approved systems.

Your administrator can arrange a private access path and, where appropriate, a jump box: a controlled computer used to reach administrative tools. Coordinate the change so authorized support can still get in. Avoid experimenting with firewall settings during a busy workday.

3. Review the vendor advisory and apply the applicable fix

Ask IT to use the advisory’s current solution table to choose the supported PAN-OS fix for your version, plan the update and confirm it installed successfully. Unit 42 says the available PAN-OS fixes interrupt the observed attack chain. Access restrictions and patching belong on the same checklist.

For separate websites or applications running PHP, your hosting provider should also review the PHP project’s official security release guidance. Updating a website’s PHP package is a different maintenance task from installing the vendor’s PAN-OS fix on a firewall.

4. Check logs and monitoring with qualified support

Ask your IT or security provider to review management-access logs, unexpected administrative changes and relevant monitoring alerts, especially if the interface was publicly reachable. Logs are the system’s activity records. Unit 42’s report includes threat-hunting guidance for qualified security teams; findings need interpretation, not a quick yes-or-no guess.

If suspicious activity appears, have the responsible team investigate and follow its incident-response process. Closing public access or installing a patch does not, by itself, establish whether an earlier compromise occurred.

A useful Friday question for Nebraska and Tampa Bay teams

People-first IT starts with questions people can actually use. Try this one: “Is our firewall’s management access private, is our software on a fixed version, and who has confirmed both?”

You do not need to memorize CVE numbers to get a clear answer. A named owner, a checked configuration and a documented update are a much better way to head into the weekend.

Sources: Unit 42 threat brief, updated October 29, 2026; Palo Alto Networks official security advisory; PHP project security release information. Security guidance can change; have your IT provider check the current vendor information.