Palo Alto Networks warns of 22 million exposed PHP instances after two critical flaws

Two critical flaws, one huge footprint

In a blog post dated October 21, 2026, Lee Klarich of Palo Alto Networks described the two PHP vulnerabilities as the opening chapter of a much faster cycle of cyberthreats. More technical details are available in a Unit 42 Threat Brief, according to the company.

The scale is what sets this case apart. Palo Alto Networks notes that PHP is widely used worldwide, by some estimates on more than half of all websites. The company puts the exposed footprint at 22 million instances.

For comparison, the post says exposures are typically in the thousands. It cites around 50,000 potentially vulnerable exposed instances for recent NetScaler vulnerabilities and about 16,000 exposed instances of BeyondTrust, potentially vulnerable to CVE-2026-1731. Pervasive open-source software, the company writes, brings an exposure footprint "on an entirely different order of magnitude."

Why patching alone falls short

Klarich argues that the latest frontier AI models are extremely capable at finding vulnerabilities in code, and that they will keep surfacing critical issues faster than before. The problem, according to the post, is what happens next: once a patch is available, attackers reverse engineer it, locate the root flaw and target it in near real time.

Applying patches to every system simply takes too long, the company says. It claims frontier AI is compressing the patch-to-exploit window to minutes, which is why it promotes virtual patching as a complement to traditional patching.

Palo Alto Networks says its new Frontier Virtual Patching capability delivered preemptive coverage for these PHP vulnerabilities ahead of the public disclosure. It adds that its customers are protected from exploitation by Advanced Threat Prevention, available on its next-generation firewalls and Prisma Access. Frontier Virtual Patching is offered in Advanced Threat Prevention Plus.

The five steps the company recommends

• Assess your open source inventory. Organizations need to understand their true exposure at a moment's notice. The company points to attack surface management and to Unit 42 Continuous Frontier AI Defense, which it says puts defender-grade AI models in the hands of defenders.
• Prioritize by reachability. Since everything cannot be patched at once, teams should focus first on what is reachable by attackers and on the exposed PHP instances that carry the most immediate risk. Cortex Xpanse and exposure management are named as tools for this.
• Secure AI deployments. Not the main focus of the PHP flaws, but the post says rapid AI rollout expands the attack surface.
• Mitigate and ensure attack protections. High-fidelity virtual patches across network and cloud security give teams time to update the actual software safely.
• Deploy real-time security operations. The company expects autonomous AI-driven attacks to push attack lifecycles to minutes, requiring every SOC to reach single-digit mean time to detect (MTTD) and mean time to respond (MTTR).

What it means for organizations

The post's central message is that vulnerability response can no longer be a one-off exercise. Assessing exposure, prioritizing by reachability and applying mitigations must become, in Klarich's words, a continuous, automated motion.

For organizations running PHP, the immediate task is to find out which instances are exposed to the internet and to rank them by risk while development teams prepare real patches. Readers should keep in mind that the figures and the threat framing come from a vendor that also sells the products it recommends, so the 22 million estimate and the minutes-long exploit window are Palo Alto Networks' own claims.