Tenable Security Intel Brief: PHP2Shell chain rooted 24 PAN-OS firewalls
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Dream says a PHP2Shell exploit chain gave an attacker root on 24 Palo Alto Networks firewalls, results Unit 42 says it confirmed. The brief also covers an unrevoked key that let an attacker publish a poisoned LiteLLM release, a Sophos report that a ransomware group told AI coding agents its intrusions were red team work, and Lumen tying a Cisco SD-WAN zero-day to Volt Typhoon. PHP2Shell chain rooted 24 exposed PAN-OS firewalls, Dream says → Brief: Dream says a custom PHP2Shell exploit (CVE-2026-109618 and CVE-2026-109619) chained with the Fragnesia Linux kernel flaw (CVE-2026-46300) gave an attacker root on 24 PAN-OS firewalls and a management server, results Palo Alto Networks' Unit 42 says it confirmed. Intel: The attack hits internet-exposed management interfaces, which Palo Alto Networks says are not exposed by default. Fixed builds are out. Dream says the chain goes from no login to root in under 15 minutes. The attacker rooted 24 of 240 firewalls. Two sat in a network Dream says appears to be US government-affiliated. From one, the attacker reached the management server and decrypted a directory account password to list every Active Directory user. Dream names no actor but sees indicators of a "Chinese-nexus" operation. CISA added the PHP CVEs to its Known Exploited Vulnerabilities catalog on October 26 and Fragnesia on October 28. Why it matters: Our Tenable Research team found PHP2Shell hard to scale because each setup needs tuning. Dream says its recovered files show tuning done for PAN-OS: 11 version profiles, one fully calibrated. Appliances that share one build are the exception, our team found: one calibrated exploit can reach many devices. Dream says the attacker used the management server's Active Directory connection to launch domain attacks, though the files Dream recovered do not show how far the compromise went. Unrevoked LiteLLM key let attacker publish poisoned PyPI release → Brief: LiteLLM, software that routes requests to AI models, says a key leaked in a public repository on May 27 and left unrevoked let an attacker push malicious version 1.107.0 to PyPI and its Docker images on October 21. Intel: According to LiteLLM, the attacker used the key on October 10 to take a GitHub organization owner's login token, then ran jobs in the project's automated build system that sent two maintainers' tokens to an outside address. On October 21 the attacker overrode branch protection, pointed the release at a lookalike repository, and approved it with a stolen maintainer token. PyPI quarantined the package that day. Socket found two of the secret-stealing workflows, from October 10 and 12, but did not link the stolen tokens to the release. LiteLLM says its audit logs tie one of the maintainer tokens stolen on October 10 to the approval. Why it matters: About three hours after the May commit, LiteLLM deleted the file and noted the key needed revoking. More than four months later it still worked. LiteLLM says it relaxed its device-locked approval rule the week of the release, so one stolen token triggered it and another approved it. An outside researcher flagged the release before LiteLLM responded. Ransomware group tells AI agents its intrusions are red team work → Brief: Sophos says GOLD OGRE, the group behind Aur0ra ransomware, used AI coding agents to escalate from stolen logins to domain administrator, the account that controls a Windows domain. Intel: To get the models to cooperate, the operators framed the break-ins as sanctioned red team exercises or as "diagnostics testing." Operators gave the agents VPN logins and proxy access and set their targets. Sophos says Cursor's Composer model and models from Anthropic, xAI and Moonshot orchestrated the intrusions. In some environments, the agents reached domain management access, and three of those victims later turned up on Aur0ra's leak site. The same analysis reads artifacts as suggesting the operators are Russian speakers. Separately, Gambit Security says an Aurora operator used Cursor Agent with Claude Sonnet as an exploitation assistant against ten organizations from April 8 to May 21. Why it matters: Sophos' workflow chart marks the first break-in and the final ransom stage as the human-controlled steps. Agents handled the steps between them with limited human involvement. In May, Sophos said a tool-building actor it now ties to GOLD OGRE likely used the same red team label to get past Claude's guardrails. Lumen ties Cisco SD-WAN zero-day exploitation to Volt Typhoon → Brief: Lumen's Black Lotus Labs says Volt Typhoon, a Chinese state-sponsored group, exploited CVE-2026-20127, a CVSS 10.0 flaw in Cisco Catalyst SD-WAN (software that manages network links between company sites), by late 2025 and kept going after Cisco's February disclosure. Intel: The report names the relay network "Silent Train," a constantly changing set of hacked routers, internet-connected devices and business equipment. We covered the flaw in February, when Talos tied its exploitation to UAT-8616. Cisco Talos now says UAT-11473 also exploited it and installed KeyDrift malware to collect keying material from SD-WAN controllers. Talos says UAT-11473's infrastructure "overlaps considerably" with Silent Train, but it does not say UAT-11473 is Volt Typhoon. That post describes historical activity with no intrusion dates. The Silent Train report never mentions UAT-11473 or KeyDrift. Why it matters: The flaw was already being exploited when Cisco disclosed it in February. Lumen now says Volt Typhoon was exploiting it by late 2025. Lumen says operators removed their tools from the relay devices and tore down each chain after every session to make the activity hard to attribute. Watching the relay network let Lumen see the exploitation. Stat of the week: 1,462 Suspects arrested by agencies from 20 African countries and the U.S. in Operation Serengeti III, a June 29 to August 31 cybercrime crackdown, according to INTERPOL, which says investigators recovered more than $105 million and linked the criminal activity to more than $385 million in losses. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: AI agents breach 395 organizations
Tenable Security Intel Brief for September 16, 2026 Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, AI agents compromised hundreds of organizations through PaperCut flaws and ignored their own targeting limits. The brief also covers Anthropic's September threat report, the BlueMoon Chrome exploit kit, and Google's findings on stolen AI accounts. AI agents hit 11 organizations in 26 seconds, then ignored orders → Brief: A likely Russian-speaking actor used hundreds of AI agents to exploit two PaperCut NG/MF flaws, compromising at least 440 instances across 395 organizations in 48 countries. Intel: On August 31, the actor ran hundreds of AI agents, using OpenAI's Codex harness paired with a DeepSeek model, to exploit CVE-2026-81578, an authentication bypass, and CVE-2026-82078, a remote code execution flaw, in PaperCut NG/MF. PaperCut manages an organization's printing, and the software typically runs with system-level privileges and connects to Active Directory. GreyNoise tracked the actor from an empty workspace to code execution on a live victim in under four hours, and once the campaign launched, 11 organizations were compromised in 26 seconds; at one US high school, seven minutes separated initial access from control of the entire domain. Why it matters: The agents ignored the actor's own list of 28 countries to avoid, and Cloudflare's WAF stopped the attack at least once. The agents achieved domain administrator access at only 12 of the 395 organizations. The agents moved faster than the actor's own intent could steer them. AI levels the field between nation-state actors and solo operators → Brief: Anthropic's "Detecting and countering misuse of AI" September 2026 threat report covering disrupted operations between December 2025 and August 2026 documents state espionage operators, financially motivated crews, and lone hacktivists running AI-driven campaigns that previously required skilled teams. Intel: One Russian-nexus actor, whose attribution is "consistent with public reporting linking the actor to Midnight Blizzard," ran agents that rebuilt malware each time security products flagged it. A Chinese-speaking group, likely based in Changsha, produced over a dozen candidate zero-days against network appliances in a month using autonomous research loops; two operators were university undergraduates. A solo French-speaking hacktivist assembled a searchable doxxing index of tens of millions of records and breached at least 14 of 42 targets, running the whole campaign alone. Why it matters: Campaigns at volumes that once required staffed teams came from a group that included two undergraduates and from a hacktivist working alone. Operational complexity no longer tells a defender who they are facing. Four actors share a Chrome exploit kit built from a public fix → Brief: Four espionage-motivated threat actors began using a shared exploit kit Proofpoint tracks as BlueMoon, which chains two Chrome V8 flaws and a Windows kernel zero-day, with China-aligned TA412 deploying it first on August 28. Intel: BlueMoon chains a V8 type confusion flaw (CVE-2026-85046) for remote code execution, a V8 sandbox escape (CVE-2026-87491), and a Windows kernel privilege escalation zero-day (CVE-2026-85880) in older Windows builds. Both V8 flaws were "patch-gap" zero-days: the CVE-2026-85046 fix was committed August 7 but did not reach a stable release until September 3, leaving the fix code publicly visible for nearly four weeks before browsers shipped it. Observed activity is majority China-nexus but not exclusively so, and how four distinct groups obtained the same kit within days remains unknown. Why it matters: When a security fix lands in open-source code before the browser ships it, the commit itself becomes a public map of the vulnerability. Here, that window ran nearly four weeks, long enough for four distinct groups to adopt and deploy the kit. Proofpoint found artifacts in the kit consistent with AI-assisted exploit development, and assesses this pattern of rapid weaponization is likely to recur. AI accounts become loot as agents run a six-hour credential harvest → Brief: Google Threat Intelligence Group (GTIG) reports that stolen AI accounts have become attacker loot, while one threat actor assembled and ran a mass credential harvesting campaign from a compromised cloud resource in under six hours. Intel: The campaign ran on preconfigured Markdown playbooks, with agents autonomously handling scanning, troubleshooting, and IP rotation. GTIG separately found an exposed command-and-control server whose live dashboard organized over 23,800 harvested secrets, cloud and AI service API keys among them. AI access itself is now loot: underground prices for stolen AI accounts more than doubled in 2026, and infostealer malware now targets AI coding tools' configuration files for their plaintext API keys. GTIG says it has "not yet observed threat actors deploying fully autonomous pipelines against targets in the wild." Why it matters: A stolen API key now unlocks more than data: it hands the thief compute capacity and a ready-made attack platform at the victim's expense. The six-hour harvest is the proof. As agents absorb the manual labor, the gap between access and a full operation shrinks, and the defender's response time shrinks with it. Stat of the week: $12.7 billion The amount of financial activity tied to suspected digital asset investment scams, also known as pig butchering, identified across 33,904 Bank Secrecy Act reports filed between September 2023 and December 2025, according to FinCEN. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.CVE-2026-46300 (Fragnesia): Frequently Asked Questions About New Linux Kernel Privilege Escalation
On May 13, researcher William Bowling of V12 Security disclosed Fragnesia (CVE-2026-46300), a new local privilege escalation vulnerability in the Linux kernel's XFRM ESP-in-TCP subsystem. The exploit works deterministically without a race condition and has a public proof-of-concept. Systems patched for the related Dirty Frag vulnerabilities remain vulnerable to Fragnesia without an additional kernel patch. CVE Description CVSSv3 CVE-2026-46300 Linux Kernel XFRM ESP-in-TCP Local Privilege Escalation Vulnerability 7.8 The module blacklist mitigation used for Dirty Frag (blacklisting esp4/esp6/rxrpc) is effective against both vulnerabilities. Organizations that applied only the Dirty Frag kernel patches need to apply the new patch released May 13. For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog.React2Shell: FAQ about React Server Components Vulnerability (CVE-2025-55182)
On December 3, the React Team published a blog post regarding a critical, maximum severity (CVSS 10) vulnerability affecting React Server Components. CVE Description CVSSv3 CVE-2025-55182 React Server Components Remote Code Execution Vulnerability 10.0 The flaw, which is an unsafe deserialization vulnerability, has been named “React2Shell” by researchers, a nod to the Log4Shell vulnerability. Additionally, the Next.js team published its own security advisory for CVE-2025-66478, a separate CVE to track the impact of CVE-2025-55182. However, the National Vulnerability Database (NVD) rejected it as a duplicate. For more information about React2Shell, including the availability of patches and Tenable product coverage, please visit our blog.Oracle E-Business Suite Zero-Day Exploited by Cl0p Ransomware Group (CVE-2025-61882)
On October 4, Oracle published a Security Alert Advisory for a zero-day in its E-Business Suite (EBS) solution: CVE Description CVSSv3 CVE-2025-61882 Oracle Concurrent Processing Remote Code Execution Vulnerability 9.8 This vulnerability was reportedly exploited in the wild by the Cl0p ransomware group. It followed earlier reports of extortion emails being sent to EBS customers by the Cl0p ransomware group. Initially, Oracle indicated that attacks used flaws in Oracle’s July 2025 CPU release. For more information about this zero-day vulnerability and associated vulnerabilities, including the availability of patches and Tenable product coverage, please visit our blog.FAQ on Exploited Zero-Day Flaws in Cisco ASA and FTD Devices (CVE-2025-20333, CVE-2025-20362)
On September 25, Cisco published three advisories for three zero-day vulnerabilities in its Cisco Adaptive Security Appliance (ASA) Software and Firewall Threat Defense (FTD) Software: CVE Description CVSSv3 Exploited CVE-2025-20333 Cisco ASA and FTD Software VPN Web Server Remote Code Execution Vulnerability (RCE) 9.9 Yes CVE-2025-20362 Cisco ASA and FTD Software VPN Web Server Unauthorized Access Vulnerability 6.5 Yes CVE-2025-20363 Cisco ASA and FTD Software, IOS Software, IOS XE Software, and IOS XR Software Web Services 9.0 No According to Cisco, two of the three zero-day vulnerabilities were exploited in the wild by the same threat actor behind 2024's ArcaneDoor campaign that also involved the exploitation of flaws in Cisco devices. For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog.
