PAN-OS and Panorama affected by unpatched PHP2Shell flaws
Palo Alto has no fixed PAN-OS builds yet; Fortinet is still checking 12 products and Cisco 31 products and services.
74
Organization
FortiGuard Labs
- Mentions · 7d0
- Mentions · 30d7
- All mentions8
- First seenAug 13, 2026
- Last mentioned9d ago
Timeline
8 articles · newest firstCasbaneiro Malware Hides C2 Activity Until Victims Visit Banking Websites
Casbaneiro hides its main command channel until Latin American victims open targeted banking sites.
58
Casbaneiro Banking Trojan Activates Only When Victims Visit Targeted Bank Websites
Casbaneiro banking trojan phishes Latin American users and starts banking C2 only after victims open targeted bank sites.
62
New Linux malware turns vulnerable IoT devices into proxy nodes
Fortinet says ClingSTUN Linux malware exploits known IoT flaws to turn devices into STUN-backed proxy nodes.
72
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure
Fortinet reports ClingSTUN, a Linux IoT backdoor that hides operator traffic using public STUN servers.
76
ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes
ClingSTUN exploits unpatched IoT flaws and uses public STUN servers to run proxy nodes.
76
Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws
FortiGuard Labs says ClingSTUN Linux backdoor abuses STUN and exploits dozens of device flaws to spread.
74
New Mirai variant adds stealth capabilities to notorious botnet code
FortiGuard Labs reports new Mirai-derived botnet Evooo1Bot actively exploits unpatched routers and edge devices, adding encrypted C2, stealthy SSH scanning, and proxying.
60
Related CVEs
by mentions- CVE-2025-6703820%9.3Unauthenticated Root Command Injection in Lantronix EDS5000 Device Servers
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2024-21887100%9.1Command Injection RCE in Ivanti Connect Secure and Policy Secure
- CVE-2023-46805100%8.2Authentication Bypass in Ivanti Connect Secure and Policy Secure Web Component
- CVE-2025-3403525%10.0Unauthenticated root command injection in EnGenius EnShare
- CVE-2022-3655391%9.8Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi
- CVE-2024-2362523%9.8A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages
- CVE-2026-3635614%9.1The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the…
Appears with
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.