Palo Alto and Citrix have not yet patched the PHP vulnerability in their firewalls and NetScaler devices that protect your company’s network. It’s not your company’s website—it’s the administrative interface of these devices, the same remote access port many people use to work remotely: if this port is exposed to the internet, the risk is immediate, and what you can do right now is block this port until a fix is available. Both companies have confirmed that their products contain the same critical PHP vulnerabilities. In both cases, the issue lies solely in the management interface, not in customer traffic. Palo Alto updated its advisory today, estimating patches between October 26 and 30, though some product lines still lack a timeline. Citrix has promised a NetScaler patch on the 27th. So far, neither has released a fix to customers. Known researcher Kevin Beaumont states that on Palo Alto virtual machines and NetScaler devices, the basic memory defense called ASLR is disabled. This is precisely the protection that causes most public PHP exploits to fail on standard servers. He also warns that exploits capable of bypassing this defense are likely to emerge within the next week—roughly coinciding with the expected release window for vendor patches. So far, Palo Alto reports no evidence of active exploitation against its products. If you run Palo Alto or NetScaler devices, immediately block the administrative interface: allow access only via trusted internal networks, with no exposure to the internet—starting with those currently open to the outside. The device guarding the port remains unlocked.