REPORTED DEVELOPMENT
An updated advisory rates the two PHP vulnerabilities affecting PAN-OS and Panorama administration HTTPS/XML APIs High at 8.7. It identifies fixed-version targets expected between 26 and 30 October, not evidence that they were already available. The vendor reports no known malicious exploitation in its products.
WHY IT MATTERS TO THE MARKET
A scheduled fix is not an installed protection; actual product, interface and version determine applicability.