I am confused. Is this attack possible even after the PHP patches OR these servers just didn't patch ?

> The affected devices run specific versions of a large vendor’s firewall software.

And the vendor's firewall software runs an unpatched version.

I bet it's fortinet.

Or Palo Alto networks

This is 100% PAN-OS