~25 Internet-Facing Palo Alto Firewalls Rooted One Week After php2shell Patch

cyb3rops · x · 2026-10-31

Huntio's one-week follow-up on the php2shell bug reports the first confirmed production compromises:

• 25 internet-facing Palo Alto PAN-OS firewalls have been rooted, reported by Dream Research, verified by Unit 42, and matched in operator logs captured via honeypots
• The chain combines two bugs: php2shell lands as nobody, then escalates to root
• On the open internet the same bug is still mostly hitting honeypots, suggesting real-target attacks are targeted
• The original prediction of limited appliance exploitation rather than mass exploitation has largely held

Original post →

More from Infra

• 5 cheap open models vote vs Opus: 89.6% accuracy at 1/10th the cost — PomegranateAble4339 · 2026-10-31
• MiniMax 3 video generation demoed running locally on a single RTX 3090 Ti — Impossible-Ad-3798 · 2026-10-31
• 15-year-old builds sliding window attention from scratch: 4.16x speedup, 21% less VRAM — vankownlaw · 2026-10-31
• Microsoft offering 60,000 employees buyouts as it shifts spend from humans to datacenters — Polymarket · 2026-10-31
• Baseten set to raise $2B at up to $30B valuation as revenue triples — rohanpaul_ai · 2026-10-31
• Betelgeuse runs 68GB Qwen MoE bit-exact at 22 tok/s on RTX 3060 + 16GB RAM — zyxciss · 2026-10-31

Infra channel →