60
60
60
60
60
Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross
60
55
Threat Brief: OWASSRF Vulnerability Exploitation
Unit 42 details active exploitation of Exchange SSRF flaws CVE-2022-41080/CVE-2022-41082 via the OWASSRF method, deploying the SilverArrow PowerShell backdoor.
Unit 42 documents OWASSRF, an exploit chain combining CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution on Microsoft Exchange via Outlook Web Access, bypassing Microsoft's ProxyNotShell mitigations. Active exploitation was observed in late November and early December 2022, affecting at least eight organizations. Attackers authenticated to Exchange, then executed a PowerShell backdoor tracked as SilverArrow to create admin accounts, install AnyDesk, tunnel RDP via PuTTY Link, and dump LSASS memory for credential theft. Exploitation is isolated rather than mass-scale because authentication is required.
55
55
35
Network Attack Trends: February
60
Network Security Trends: November 2021 to January 2022
60
Network Security Trends: August
60
57
60
60
55
60
60
Next
Palo Alto Networks product-category page describing Next-Generation Firewall threat detection, including encrypted traffic; no standalone article.
The page is a product category listing for Palo Alto Networks Next-Generation Firewalls, stating the products detect known and unknown threats, including in encrypted traffic, using intelligence from many thousands of customer deployments. It contains no research findings, vulnerabilities, or incident details relevant to defenders.
10
30
60
Network Attack Trends: Internet of Threats (November 2020
60
Best Practice Assessment Archives
Palo Alto Networks' Best Practice Assessment measures Next-Generation Firewall and Panorama configuration usage, enabling customers to strengthen security and maximize return on investment.
The Palo Alto Networks Best Practice Assessment measures usage of Next-Generation Firewall and Panorama security management capabilities across a customer deployment. The results are intended to guide configuration adjustments that strengthen security posture and maximize return on investment. The page is an archive listing for this product category rather than a new disclosure or release.
10
47
30
30
30
30
CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild (SpringShell) (Updated)
Attackers actively exploit Spring Framework RCE CVE-2022-22965 (SpringShell, CVSS 9.8) to deploy webshells; patches 5.3.18/5.2.20 shipped March 31, 2022.
CVE-2022-22965 enables unauthenticated remote code execution in the widely used Spring Framework (CVSS 9.8), which Unit 42 has observed being exploited in the wild. The flaw stems from getCachedIntrospectionResults exposing the class object during parameter binding, letting attackers manipulate the class loader to modify Tomcat logging and upload a JSP webshell. Public PoCs require JDK 9+, Tomcat, WAR packaging, and spring-webmvc or spring-webflux dependencies on Spring 5.3.0-5.3.17, 5.2.0-5.2.19, or older. Fixes shipped in Spring Framework 5.3.18 and 5.2.20; the related Spring Cloud Function flaw CVE-2022-22963 was patched March 29, 2022.
82
60
60
55
60
30
30
30
30
55
55