PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
88
- Mentions · 7d9
- Mentions · 30d45
- All mentions138
- First seenAug 11, 2026
- Last mentioned23h ago
Timeline
138 articles · newest firstSuspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell
The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.
86
Palo Alto confirms PHP2Shell attacks on exposed PAN-OS management
Unit 42 verified tools that pair the PHP flaws with kernel bug CVE-2026-46300 for root; about 0.02% of the installed base was exposed.
86
Buyer’s guide compares 12 incident response retainer services
The review weighs SLAs, unused-hour conversion, onboarding and post-acquisition ownership rather than responder reputation alone.
24
2026 ranking puts Recorded Future first among CTI providers
Mandiant and CrowdStrike place second and third; Kaspersky is flagged as jurisdiction-gated for Western buyers.
17
php2shell RCE confirmed on honeypots and some network appliances
Public PoCs often fail unless tuned to one PHP build, but shared appliance images let one exploit hit many devices.
82
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
84
INJ3CTOR3 steals FreePBX credentials so toll fraud survives cleanup
A September installer uploads secrets from 17 telephony, database, and mail files; researchers saw no live theft.
64
Unit 42 warns retailers of ransomware, extortion and DDoS
As of September 30, 2026, operators had claimed 565 retail victims, with median revenue about $22 million.
34
Palo Alto says PHP RCE flaws affect PAN-OS; hotfixes still pending
CVE-2026-109618 and CVE-2026-109619 hit several PAN-OS branches via management interfaces; Palo Alto reports no attacks on its products.
74
Attacker used DeepSeek to steal 5,200 Indian university records
Unit 42 says a weak administrator password, not a new software flaw, exposed the MongoDB holding student and staff data.
62
Unit 42: BUGSTER used DeepSeek V4 in India university data theft
The actor brute-forced a site and stole more than 5,200 student and faculty PII records, Unit 42 says.
64
OAuth token theft bypasses MFA and outlives password resets, Unit 42 says
Stolen access and refresh tokens can persist for days or months and move across services tied to the same identity.
34
AI-scripted campaign hit government Linux servers, Unit 42 says
Cluster CL-UNK-1211 used web shells, a sudo-password hook, and SysGoRAT while hunting databases and mailboxes.
74
October 21 fixes cover PHP2Shell, LiteLLM theft, and VPN attacks
Fixed PHP builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; LiteLLM 1.107.0 stole secrets, so pin 1.106.2 and rotate them.
86
BUGSTER used jailbroken AI to hit Indian universities, Unit 42 says
The actor dumped more than 5,200 student records and planned VoIP fraud, Wi-Fi cracking, and crypto reconnaissance.
72
Unit 42 warns of two critical PHP RCE flaws scored 9.2
Unit 42 says it has seen proof-of-concept code and telemetry showing over 22.6 million potentially exposed instances.
78
Ransomware groups exploit Palo Alto GlobalProtect flaw CVE-2026-0257
Unit 42 has investigated intrusions since early June; Qilin, Inc, and Settra are among the operators named.
84
Ransomware groups exploit Palo Alto PAN-OS bug CVE-2026-0257
Unit 42 says Qilin, Inc and others use the GlobalProtect flaw for unauthorized VPN access, then ransomware, across many industries.
84
Qilin and INC exploit patched Palo Alto VPN bypass (CVE-2026-0257)
Unit 42 says the groups still use the May 2026 PAN-OS and Prisma Access fix to open unauthorized VPNs.
78
Qilin and INC exploit patched PAN-OS flaw to bypass MFA
Unit 42 says CVE-2026-0257 yields unauthorized VPN sessions, followed by RDP, SMB, and ransomware staging.
82
Ransomware groups exploit PAN-OS flaw CVE-2026-0257 to bypass MFA
Unit 42 says the GlobalProtect cookie bug yielded VPN access and later ransomware across several sectors since early June 2026.
82
Ransomware groups exploit GlobalProtect MFA bypass CVE-2026-0257
Unit 42 says attackers forged authentication-override cookies, then pulled domain credentials from a VMware virtual disk offline.
84
Qilin and Inc exploit PAN-OS GlobalProtect bypass CVE-2026-0257
Unit 42 says operators bypass MFA for VPN access, then move via RDP and SMB toward ransomware.
88
AI-Assisted Hackers Compromise Government Linux Servers to Deploy Backdoors and Steal Credentials
Unit 42 says unattributed cluster CL-UNK-1211 backdoored government Linux servers and stole administrator credentials.
74
CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability
Attackers are actively exploiting critical unauthenticated NetScaler RCE CVE-2026-88771, now listed in CISA's KEV catalog.
86
Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026
Unit 42 says September 2026 intrusions most often began with edge exploits and abused credentials.
46
Hackers Use AI-Generated Scripts to Hijack Linux Sudo Commands and Steal Passwords
Unit 42 says CL-UNK-1211 used AI-assisted scripts to steal Linux sudo passwords from government targets.
76
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
Unit 42 says PEERSTITCH, planted through FortiManager flaws, exposed material for more than 500 firewalls.
82
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
Unit 42 says CL-STA-0954 used Fortinet flaws to deploy memory-resident PEERSTITCH against a telecom provider.
84
AI-Powered Espionage Campaign Targets Government Linux Infrastructure
Unit 42 says cluster CL-UNK-1211 used AI-generated payloads to spy on government Linux infrastructure.
78
New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory
Unit 42 details PEERSTITCH, a memory-resident implant used against FortiGate firewalls at a telecom MSP.
80
Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Attackers exploited Fortinet flaws at a telecom MSP and deployed the stealthy PEERSTITCH implant on FortiGate firewalls.
82
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
Unit 42 says UNC5820 stole data on 500-plus FortiGates and deployed memory-resident PEERSTITCH malware.
84
The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk
An opportunistic attacker used stolen credentials and a misconfigured gateway to probe a European bank.
46
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
Qilin and Settra are still exploiting Palo Alto CVE-2026-0257 to open unauthorized VPN sessions.
78
Suspected TraderTraitor Hackers Trojanize Terraform Provider to Deploy Cross-Platform Malware
Suspected North Korean hackers trojanized a Terraform provider to install FLATROOF and ROOFDECK on developer machines.
76
Hackers Use Web3 and Blockchain C2 to Hide Supply Chain Attacks Targeting Cloud Credentials
Unit 42 says the ChainDrop npm worm uses Ethereum smart contracts as C2 to steal cloud and developer credentials.
79
AWS’s repeated problems with AI agent controls illustrates the autonomous agent dilemma
Unit 42 and Zenity say AWS AgentCore defaults let prompt injection steal credentials and move across agents.
70
ChainDrop and PolinRider Use Blockchain C2 to Steal Cloud and CI/CD Credentials
ChainDrop and North Korea-linked PolinRider use blockchain C2 to steal cloud and CI/CD credentials.
78
Related CVEs
by mentions- CVE-2026-025795%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2023-2753281%7.5Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials
- CVE-2024-4757595%9.8Unauthenticated RCE in Fortinet FortiManager and FortiManager Cloud
- CVE-2025-616241%6.5Authenticated path traversal in Fortinet FortiOS and related products
- CVE-2026-4630016%7.8Shared-frag marker loss in Linux kernel skb coalescing (LPE)
- CVE-2023-38054<1%8.1A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer)
- CVE-2026-6389<1%7.8IBM Turbonomic prometurbo agent 8.16.0 through 8.17.6 IBM Turbonomic Application Resource Management grants excessive cluster‑wide permissions, including…
- CVE-2023-3289<1%6.5A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin)
Appears with
- Palo Alto Networksvendor · 97
- Palo Alto Networksorganization · 49
- Microsoftvendor · 18
- Cortex XDRproduct · 14
- PAN-OSproduct · 14
- CISAorganization · 12
- Qilinthreat actor · 9
- Googlevendor · 7
- GlobalProtectproduct · 7
- Angler EKmalware · 6
- Advanced URL Filteringproduct · 6
- Incthreat actor · 6
- PHPproduct · 5
- FortiGateproduct · 5
- Prisma Accessproduct · 5
- UNC5820threat actor · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.