#firewall

Read Time:3 Minute, 49 Second

A single exposed firewall management interface was apparently enough to set off a chain reaction that ended with root access on two dozen systems, including machines inside a US government-affiliated network. Researchers at the threat-hunting firm Dream say they recovered a trove of attacker tooling on October 25, 2026, that lays out the entire operation step by step: custom exploit code, lists of targets, attack logs, and roughly 40 scripts meant to be run after a server was already compromised.

Two Bugs, One Fifteen-Minute TakeoverAt the center of the campaign is a pairing the researchers call PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, combined with a Linux kernel privilege-escalation bug nicknamed Fragnesia and tracked as CVE-2026-46300. Unlike a copy-pasted public proof-of-concept, Dream describes the PHP2Shell code as a bespoke implementation built specifically for the targeted firewall vendor’s management software.

The attack abused PHP’s session.upload_progress feature inside the firewall’s web management server. By forcing the service to exhaust its own memory and leak a memory address, the attacker was able to corrupt internal data structures and run commands as a low-privilege account. From there, the Fragnesia kernel flaw rewrote local authentication records, handing the intruder a root shell without ever supplying a password. Investigators estimate the entire sequence, from first contact to an installed root webshell, took under 15 minutes.

Casting a Wide Net, Then Narrowing ItThe attacker reportedly used the internet-scanning service FOFA to identify roughly 19,000 firewalls exposed to the public internet. Only about 5,000 of those revealed their software version, and after filtering by geography and version number, the target list shrank to 240 candidates. Of those, 24 firewalls across the United States, Japan, Taiwan, and South Korea were successfully compromised, with webshells planted on 22 of them. Dream found no evidence of further activity on most of those machines beyond the initial foothold.

A Deeper Push Into a Government NetworkTwo firewalls tied to a US government-affiliated organization drew more sustained attention. After an initial attempt caused one device to crash, the attacker returned on October 24 and successfully compromised a second firewall, this time setting up a reverse SSH tunnel that forwarded eight internal ports and was configured to survive a reboot. Through that tunnel, the same exploit chain was launched again, this time against an internal firewall management server reachable only from inside the network. That server became the 25th and final confirmed victim, exposing centrally managed configuration data and credentials for the organization’s wider fleet of firewalls.

Reaching Into Active DirectoryFrom the compromised management server, the attacker decrypted a stored LDAP service-account password and used it to enumerate Active Directory users and groups. Dream’s analysis also turned up signs of attempted password spraying, creation of a backdoor account, and an attempt to steal a SAML signing key, though the researchers say it is not yet clear whether any of these follow-on efforts actually succeeded. That distinction matters for incident responders: compromising a firewall is not the same as confirming an attacker achieved domain-wide control, and the two should not be conflated when scoping a response.

Hints of a Chinese Connection, but No Firm AttributionAmong the recovered files, Dream found references to Claude Code and an AI-assisted scanning setup built around the DeepSeek and Kimi models, along with prompts written in Chinese and timestamps consistent with the UTC+8 time zone. Those details support a working theory that the operators may be based in China, but the researchers stop short of naming a specific group, and they found nothing proving that AI tools authored the exploit code itself or ran the operation autonomously.

What Organizations Should DoThe affected firewall vendor has been notified but has not been publicly named while a fix is prepared, so Dream’s guidance for now is generic but still useful:

Treat internet-facing firewall management interfaces as high-value targets and restrict access to them wherever possible.

Apply vendor patches as soon as they become available, rather than waiting for a named advisory.

Assume that a compromised management appliance may have exposed stored credentials, and rotate them even after the entry point itself is patched.

Audit Active Directory for new accounts, password-spray attempts, and signing-key access tied to the timeframe of any suspected compromise.

The underlying lesson, researchers emphasize, is that patching the initial vulnerability does not automatically answer the harder question of whether stolen credentials, tunnels, or webshells are still usable somewhere inside the network.

Read Time:3 Minute, 33 Second

WatchGuard has published a sweeping security advisory covering 18 vulnerabilities across its Fireware OS and the Windows Mobile VPN with SSL client, with seven of those flaws rated critical and carrying CVSS scores between 9.1 and 9.5. The October 27, 2026 disclosure touches Firebox firewalls broadly, and several of the most severe bugs can be triggered by an attacker who hasn’t logged in at all.

The Headline Bug: A WireGuard Buffer OverflowThe single highest-rated issue, CVE-2026-103594, scores 9.5 on the CVSS scale and stems from a stack buffer overflow in how Fireware OS handles WireGuard VPN configuration, opening the door to remote code execution. The flaw affects Fireware OS versions 2026.2 up to (but not including) 2026.4, as well as the 12.12 branch prior to 12.12.4 — a wide enough range that most currently deployed Fireboxes using WireGuard are likely exposed until patched.

Pre-Authentication Flaws in Active Directory and SIP HandlingTwo additional critical bugs, CVE-2026-112709 and CVE-2026-112710, each carry a 9.2 score and involve heap buffer overflows in the firewall’s Active Directory authentication service. WatchGuard’s own advisory confirms that at least CVE-2026-112710 can be exploited for remote code execution before a user ever authenticates — meaning an attacker with network access to the service doesn’t need valid credentials to attempt exploitation. A related pre-authentication bug, CVE-2026-93857, also scored 9.2, affects the SIP proxy through a separate stack buffer overflow with the same remote code execution outcome. Rounding out the logging side, CVE-2026-103593 (9.1) is a stack buffer overflow in the firewall’s logging service that can likewise lead to code execution.

Root-Level Risk From Clustering and Access Portal BugsTwo more critical entries involve root-level exposure through different mechanisms. CVE-2026-93865, scored 9.2, is a missing-authentication flaw in the FireCluster synchronization daemon that WatchGuard says allows remote injection of root-level actions — a serious concern for any organization running Fireboxes in a clustered, high-availability configuration. CVE-2026-93866, also 9.2, is an integer overflow in the pre-authentication Access Portal that leads to an out-of-bounds memory write; WatchGuard’s advisory describes this as memory corruption rather than confirmed remote code execution, which is a meaningful distinction for teams prioritizing patch rollout.

The Seven Critical Flaws at a GlanceCVE-2026-103594 — CVSS 9.5 — WireGuard configuration — stack buffer overflow enabling remote code execution.

CVE-2026-112710 — CVSS 9.2 — Active Directory service — heap buffer overflow, pre-authentication remote code execution.

CVE-2026-112709 — CVSS 9.2 — Active Directory service — heap buffer overflow.

CVE-2026-93865 — CVSS 9.2 — FireCluster sync daemon — missing authentication, root-level action injection.

CVE-2026-93857 — CVSS 9.2 — SIP proxy — stack buffer overflow, pre-authentication remote code execution.

CVE-2026-93866 — CVSS 9.2 — Access Portal — integer overflow, out-of-bounds write.

CVE-2026-103593 — CVSS 9.1 — Logging service — stack buffer overflow enabling remote code execution.

Lower-Severity Bugs Still Worth WatchingBeyond the critical seven, two additional issues stand out for their potential impact despite lower scores. CVE-2026-90464 lets an already-authenticated attacker modify arbitrary files with root privileges because the affected component fails to validate commands properly, while CVE-2026-93864 allows a local attacker to overwrite arbitrary files as root by abusing a symlink-following flaw in firewalld. Neither requires remote, unauthenticated access, but both hand significant power to an attacker who has already gained a foothold.

Patch AvailabilityWatchGuard’s published fix guidance points to Fireware OS 2026.4 and 12.12.4 as the versions that resolve most of the listed issues, with T15 and T35 hardware requiring 12.5.22 specifically. The Windows Mobile VPN with SSL client’s separate credential-exposure issue is likewise resolved in the 2026.4 release. It’s worth noting this October disclosure is distinct from an earlier, separately tracked WatchGuard zero-day (CVE-2025-14733) that saw confirmed exploitation — there is no indication at this time that any of the 18 newly disclosed flaws have been exploited in the wild, though the combination of high severity and pre-authentication reachability makes rapid patching a priority for any organization running Firebox appliances.

Read Time:3 Minute, 49 Second

Palo Alto Networks has published an advisory confirming that a critical vulnerability in the open-source Brotli compression library reaches into some of its PAN-OS firewall deployments, along with a companion tool used in its Prisma Cloud offering. The flaw, tracked as CVE-2026-111497, carries a severity score of 9.2 out of 10 — putting it firmly in critical territory, even though Palo Alto itself has only assigned the issue moderate response urgency internally.

What the Bug Actually DoesThe root cause sits inside decode.c, part of Google’s Brotli decompression engine. A specially crafted compressed data stream can trigger what’s known as an out-of-bounds write — essentially tricking the decoder into writing data past the boundary of the memory buffer it’s supposed to stay inside. Depending on how that memory gets overwritten, the consequences can range from corrupting unrelated data and crashing a service, to exposing sensitive information, to a worst-case scenario of unauthenticated remote code execution.

Google has already shipped fixed versions of the underlying Brotli library — 1.0.10, 1.1.1, and 1.2.1, depending on the release branch — but because Brotli is embedded inside a wide range of downstream software, each vendor that bundled a vulnerable copy has to ship its own fix separately. This isn’t the first product caught up in the fallout: Node.js previously issued security updates addressing the same decoder flaw, underscoring how a single open-source dependency bug can ripple across unrelated products for weeks.

Who’s Actually ExposedFor PAN-OS customers, exposure isn’t universal — it depends entirely on configuration. A firewall is only at risk if both of the following are true:

Brotli traffic inspection is enabled on the dataplane (the component that actually processes network traffic)

TLS/SSL decryption is also enabled, since that’s what exposes the compressed content to inspection in the first place

Critically, Brotli inspection ships disabled by default and isn’t even supported on PAN-OS versions before 11.2.4. That means PAN-OS 11.1 and 10.2 branches are unaffected entirely, as are Panorama and M-Series management appliances. The firewall’s management web interface and API are also outside the blast radius — this is strictly a dataplane traffic-inspection issue.

Administrators running PAN-OS 11.2.4 or later can check their exposure directly with the command show system setting brotli. A result of Enabled: yes means Brotli inspection is active, though TLS/SSL decryption still needs to be confirmed separately to fully assess risk.

Workarounds Available Now, Patches Coming LaterBecause official hotfixes won’t be available until October 27–30 at the earliest, Palo Alto is urging customers to mitigate immediately rather than wait. The recommended workaround depends on the PAN-OS version:

Via CLI: run set system setting brotli-encoding disable, then confirm with show system setting brotli that it now reports Enabled: no

On PAN-OS 12.1.2 and later: navigate to Device > Setup > Content-ID, clear the “Allow Brotli Encoding” option, and commit the change

Customers subscribed to Threat Prevention get an additional, partial layer of coverage through Threat ID 97686, included in Applications and Threats content version 9165 or later — but Palo Alto is explicit that this signature-based protection is conditional on specific traffic routing, decryption, and policy settings, and should not be treated as a substitute for disabling the feature outright.

The planned hotfix builds span a wide swath of the PAN-OS release tree, including 12.2.4-h1, 12.1.4-h13, 12.1.10-h3, 11.2.4-h23, 11.2.10-h17, and 11.2.16-h1, among others. Palo Alto flags one easy-to-miss detail: 11.2.10-h16 only resolves a separate, unrelated PHP issue — it’s 11.2.10-h17 that adds the Brotli fix, so teams tracking build numbers should double-check they’re grabbing the right one.

Prisma Cloud Users Also AffectedOutside the firewall line, Palo Alto’s Prisma Cloud Application Security Transporter Client also ships a vulnerable Brotli copy and needs to be upgraded to version 0.2.9 or later. The company says several of its own cloud services — including ADEM, Cloud Identity Engine, Hub, and Prisma AIRS Gateway — have already been remediated on the backend, requiring no customer action.

With no confirmed exploitation in the wild but a critical severity score and a multi-day gap before official patches land, the practical move for affected organizations is straightforward: disable Brotli inspection now, verify the setting took effect, and schedule the hotfix once it’s confirmed available for the specific build in use.

Read Time:3 Minute, 58 Second

Palo Alto Networks has confirmed that a pair of critical remote-code-execution flaws in the PHP language runtime extend into its own PAN-OS firewall software and Panorama management platform, and that fixes won’t be fully available for roughly a week after the advisory update.

The two issues, tracked as CVE-2026-109618 and CVE-2026-109619, stem from how PHP handles severe internal errors through a function called longjmp(), which abruptly jumps program execution back to an earlier saved checkpoint. When that jump happens at the wrong moment, it can leave stale or uninitialized memory behind — memory that a later part of the program may then act on, opening a path for an attacker to run their own code.

Two Related but Distinct FlawsCVE-2026-109618 is triggered when the server runs out of memory partway through handling a request, leaving that request’s memory in an incomplete state. If cleanup routines later operate on that incomplete memory, an attacker who can reliably force memory exhaustion may be able to turn the resulting instability into remote code execution.

CVE-2026-109619 is a related but separate issue involving global memory references that continue pointing at memory after it has already been freed. A subsequent request that reads or acts on one of those dangling references can again give an attacker a route to execute arbitrary code.

Both flaws trace back to the broader PHP vulnerability research effort published under the name “PHP2Shell,” which carries a CVSS v4.0 base score of 9.2. Palo Alto has assessed its own product-specific exposure slightly lower, at 8.7, and notes that for its products the primarily affected security property is availability rather than confirmed data theft or configuration tampering — though the company is careful to frame that as the current assessment, not a guarantee against more severe impact.

Scope: Management Interfaces, Not GlobalProtectAccording to the updated advisory, the vulnerable surface is limited to PAN-OS management interfaces — the HTTPS administrative console and the XML API — rather than the data-plane components most organizations expose to end users. A dataplane interface is only affected if it has a management profile explicitly attached to it. Notably, GlobalProtect portals and gateways, Clientless VPN, and Captive Portal are all listed as unaffected, which should reduce panic for organizations whose remote-access infrastructure runs through those services.

Affected branches span a wide swath of PAN-OS releases, including 10.2, 11.1, 11.2, 12.1, and 12.2, running on PA-Series and VM-Series firewalls, as well as Panorama (including virtual and M-Series deployments). No unusual configuration is required to be vulnerable — any device on an affected branch with its management interface reachable is a candidate for exploitation.

Two cloud-delivered products, Cortex XCORE SaaS and WildFire Cloud, were also affected but have already received fixes, delivered on October 21 and October 22 respectively. Cloud NGFW, Cortex XDR, Cortex XSIAM, Prisma Cloud, Prisma Access, and the GlobalProtect App are all currently listed as unaffected by this issue.

Patches Are Still ComingAs of the October 24 advisory update, Palo Alto said it has no evidence of malicious exploitation against its own products — but that comes with an important caveat: security researchers at Unit 42 have already observed proof-of-concept exploit code circulating for the broader PHP2Shell vulnerabilities, meaning the gap between disclosure and active abuse could close quickly.

Firmware fixes are still on a rolling schedule rather than available today. The earliest hotfixes — versions 10.2.18-h13, 11.1.16-h4, and 11.2.10-h16 — are estimated for October 26, with PAN-OS 12.2.4-h1 targeted for October 28 and additional hotfixes planned through October 30. Palo Alto has emphasized that these dates are estimates and may shift.

What Administrators Should Do NowRestrict access to PAN-OS and Panorama management interfaces to trusted internal IP ranges or a dedicated jump host — internet-facing management interfaces represent the highest-risk configuration.

Where possible, enable Threat Prevention coverage for this issue, which Palo Alto has tied to signature 543004 and subsequent content updates (versions 9162 through 9164 and later). Doing so requires routing management traffic through a dataplane port, configuring an inbound certificate, and enabling HTTPS decryption and inspection.

Track each affected device’s specific hotfix path against Palo Alto’s advisory and Unit 42’s threat brief, since release timing varies by branch.

Treat access restrictions as a stopgap, not a substitute for installing the fixed release once it becomes available for each platform.

The disclosure is a reminder that vulnerabilities in widely used runtimes like PHP don’t stay contained to web applications — they can resurface inside the management stacks of the very security appliances organizations rely on to keep attackers out.