.webp&w=828&q=75)
Criminal IP releases Splunk TI Feed app for firewall correlation
The Splunkbase app refreshes Criminal IP data every three hours and correlates it with firewall logs every 10 minutes.
Stories per day · 30 days
3 RSS
Relatedpan-os12palo-alto9cve-2026-03228php2shell8kev7rce7privilege-escalation5webshell5cisa4zero-day4active-directory3code-injection3php3remote-code-execution3china2cisco2criminal-ip2fragnesia2
54 stories, newest first · one card per story
Stories tagged #firewall
Wordfence 9.1.0 adds a news widget, faster rules and login logging
Firewall parsing is tighter, rule checks are more frequent, and PHP 8.6 compatibility is included for every license.
IPFire releases fireperf firewall testing tool
fireperf measures firewall connection handling rates like iperf3 but for stateful devices.
Attackers chain PHP2Shell flaws to root Palo Alto PAN-OS firewalls
Hunt.io says 24 perimeter firewalls and one internal management server were compromised, including a US government-affiliated environment.
Palo Alto confirms PHP2Shell attacks on exposed PAN-OS management
Unit 42 verified tools that pair the PHP flaws with kernel bug CVE-2026-46300 for root; about 0.02% of the installed base was exposed.
Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
Cisco patches exploited ASA and FTD SSL VPN flaw CVE-2026-76418
Unauthenticated crafted VPN requests can reload firewalls; CVSS is 8.6 and there is no workaround.
Attackers chain PHP2Shell flaws to root 25 firewall servers
Dream says the chain, including kernel flaw CVE-2026-46300, rooted devices in the US, Japan, Taiwan, and South Korea in under 15 minutes.
Attackers chain PHP2Shell and kernel exploits for root on 25 servers
Dream says custom exploits for CVE-2026-109618, CVE-2026-109619 and CVE-2026-46300 reached government-affiliated firewalls and Active Directory.
WatchGuard discloses seven critical Fireware OS flaws enabling remote code execution
Supplied data names Fireware OS 2026.4 and 12.12.4 as fixes; this report does not establish exploitation.
2
China-linked hackers root firewalls via PHP2Shell and Fragnesia
Dream says attackers exploited 25 of 19,000 internet-facing firewalls on October 23-24 and planted root webshells on 24.
Palo Alto says PHP RCE flaws affect PAN-OS; hotfixes still pending
CVE-2026-109618 and CVE-2026-109619 hit several PAN-OS branches via management interfaces; Palo Alto reports no attacks on its products.
Unnamed pharmacy chain used 'password' on a Cisco edge firewall
The enable secret was Cisco IOS type 7, a reversible encoding with a publicly known key.
CISA Warns of Palo Alto Networks PAN-OS Code Injection Vulnerability Exploited in Attacks
CISA added PAN-OS code injection flaw CVE-2026-0322 to the KEV catalog after real-world attacks; federal agencies must mitigate by October 17.
7
Palo Alto Warns of PAN-OS 0-day Flaw Actively Exploited in Attacks
Palo Alto says attackers are exploiting CVE-2026-0322, an authenticated PAN-OS management RCE that yields root.
Palo Alto Networks (PAN-OS) Remote Code Execution Vulnerability Exploited in Attack (CVE-2026-0322)
Attackers are exploiting CVE-2026-0322, an authenticated PAN-OS flaw that enables root code execution.
Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix
Attackers are exploiting PAN-OS CVE-2026-0322 for root access; CISA set a three-day fix.
Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
Palo Alto patched PAN-OS zero-day CVE-2026-0322 after limited exploitation for root remote code execution.
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto patches exploited PAN-OS management RCE CVE-2026-0322; CISA set an October 17 deadline.
Hackers Exploit Palo Alto PAN-OS 0-day Flaw to Gain Root Code Execution on Firewalls
Attackers are exploiting PAN-OS CVE-2026-0322 for limited root code execution through the management interface.
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
Palo Alto says attackers are exploiting PAN-OS RCE CVE-2026-0322, which CISA added to KEV.
CISA adds authenticated PAN-OS root RCE to KEV (CVE-2026-0322)
An authenticated attacker on the management network can run code as root on PA-Series, VM-Series, and Panorama; agencies must act by October 17.
1
Government contractor exposed path to immigration records
Contractor firewall change exposed a classified server holding 50 million immigration records to thousands of VPN users until a researcher's demo forced rollback.
1