Threat Intelligence Brief
Curated summary with source attribution
Source: securityweek.com
Threat Risk: High
Victim: Organizations using Palo Alto Networks PAN-OS firewalls
Incident: China-linked actors are exploiting a chain of PHP and kernel vulnerabilities to root network firewalls.
Impact: Attackers gain full root access to critical network security appliances, enabling total network compromise.
Attacker: China-linked hacking group
Analysis: Threat actors are combining PHP2Shell vulnerabilities with the Fragnesia kernel bug to bypass security and gain administrative privileges. The campaign specifically targets internet-facing management interfaces on PAN-OS devices. While generic PHP installations like WordPress have remained largely resilient, the precision of these attacks against network hardware demonstrates a sophisticated targeting strategy.
Recommendations: Immediately apply patches for PAN-OS versions 10.2 through 12.2; Restrict management interface access to trusted internal networks only; Audit internet-facing PHP instances for unauthorized webshells
Source: SecurityWeek
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source