Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team.

This week, Dream says a PHP2Shell exploit chain gave an attacker root on 24 Palo Alto Networks firewalls, results Unit 42 says it confirmed. The brief also covers an unrevoked key that let an attacker publish a poisoned LiteLLM release, a Sophos report that a ransomware group told AI coding agents its intrusions were red team work, and Lumen tying a Cisco SD-WAN zero-day to Volt Typhoon.

PHP2Shell chain rooted 24 exposed PAN-OS firewalls, Dream says →

Brief: Dream says a custom PHP2Shell exploit (CVE-2026-109618 and CVE-2026-109619) chained with the Fragnesia Linux kernel flaw (CVE-2026-46300) gave an attacker root on 24 PAN-OS firewalls and a management server, results Palo Alto Networks' Unit 42 says it confirmed.

Intel: The attack hits internet-exposed management interfaces, which Palo Alto Networks says are not exposed by default. Fixed builds are out. Dream says the chain goes from no login to root in under 15 minutes. The attacker rooted 24 of 240 firewalls. Two sat in a network Dream says appears to be US government-affiliated. From one, the attacker reached the management server and decrypted a directory account password to list every Active Directory user. Dream names no actor but sees indicators of a "Chinese-nexus" operation. CISA added the PHP CVEs to its Known Exploited Vulnerabilities catalog on October 26 and Fragnesia on October 28.

Why it matters: Our Tenable Research team found PHP2Shell hard to scale because each setup needs tuning. Dream says its recovered files show tuning done for PAN-OS: 11 version profiles, one fully calibrated. Appliances that share one build are the exception, our team found: one calibrated exploit can reach many devices. Dream says the attacker used the management server's Active Directory connection to launch domain attacks, though the files Dream recovered do not show how far the compromise went.

Unrevoked LiteLLM key let attacker publish poisoned PyPI release →

Brief: LiteLLM, software that routes requests to AI models, says a key leaked in a public repository on May 27 and left unrevoked let an attacker push malicious version 1.107.0 to PyPI and its Docker images on October 21.

Intel: According to LiteLLM, the attacker used the key on October 10 to take a GitHub organization owner's login token, then ran jobs in the project's automated build system that sent two maintainers' tokens to an outside address. On October 21 the attacker overrode branch protection, pointed the release at a lookalike repository, and approved it with a stolen maintainer token. PyPI quarantined the package that day. Socket found two of the secret-stealing workflows, from October 10 and 12, but did not link the stolen tokens to the release. LiteLLM says its audit logs tie one of the maintainer tokens stolen on October 10 to the approval.

Why it matters: About three hours after the May commit, LiteLLM deleted the file and noted the key needed revoking. More than four months later it still worked. LiteLLM says it relaxed its device-locked approval rule the week of the release, so one stolen token triggered it and another approved it. An outside researcher flagged the release before LiteLLM responded.

Ransomware group tells AI agents its intrusions are red team work →

Brief: Sophos says GOLD OGRE, the group behind Aur0ra ransomware, used AI coding agents to escalate from stolen logins to domain administrator, the account that controls a Windows domain.

Intel: To get the models to cooperate, the operators framed the break-ins as sanctioned red team exercises or as "diagnostics testing." Operators gave the agents VPN logins and proxy access and set their targets. Sophos says Cursor's Composer model and models from Anthropic, xAI and Moonshot orchestrated the intrusions. In some environments, the agents reached domain management access, and three of those victims later turned up on Aur0ra's leak site. The same analysis reads artifacts as suggesting the operators are Russian speakers. Separately, Gambit Security says an Aurora operator used Cursor Agent with Claude Sonnet as an exploitation assistant against ten organizations from April 8 to May 21.

Why it matters: Sophos' workflow chart marks the first break-in and the final ransom stage as the human-controlled steps. Agents handled the steps between them with limited human involvement. In May, Sophos said a tool-building actor it now ties to GOLD OGRE likely used the same red team label to get past Claude's guardrails.

Lumen ties Cisco SD-WAN zero-day exploitation to Volt Typhoon →

Brief: Lumen's Black Lotus Labs says Volt Typhoon, a Chinese state-sponsored group, exploited CVE-2026-20127, a CVSS 10.0 flaw in Cisco Catalyst SD-WAN (software that manages network links between company sites), by late 2025 and kept going after Cisco's February disclosure.

Intel: The report names the relay network "Silent Train," a constantly changing set of hacked routers, internet-connected devices and business equipment. We covered the flaw in February, when Talos tied its exploitation to UAT-8616. Cisco Talos now says UAT-11473 also exploited it and installed KeyDrift malware to collect keying material from SD-WAN controllers. Talos says UAT-11473's infrastructure "overlaps considerably" with Silent Train, but it does not say UAT-11473 is Volt Typhoon. That post describes historical activity with no intrusion dates. The Silent Train report never mentions UAT-11473 or KeyDrift.

Why it matters: The flaw was already being exploited when Cisco disclosed it in February. Lumen now says Volt Typhoon was exploiting it by late 2025. Lumen says operators removed their tools from the relay devices and tore down each chain after every session to make the activity hard to attribute. Watching the relay network let Lumen see the exploitation.

Stat of the week: 1,462

Suspects arrested by agencies from 20 African countries and the U.S. in Operation Serengeti III, a June 29 to August 31 cybercrime crackdown, according to INTERPOL, which says investigators recovered more than $105 million and linked the criminal activity to more than $385 million in losses.

Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.