Threat Intel
Ok, I’m going to say this again, stop exposing your really sensitive services management interfaces directly to the internet! That means firewalls, VPN servers etc. I blogged earlier how this has been a known thing since at least the 2000 era! Stop it! Now, you might so, but Daniel, what about Cloud deployments? Well they come with some interesting features, but you can still restrict the interfaces down to specific IP addresses from a network ingress pov, so if you must put them on the internet (no choice wth cloud to some point) then at least network restrict them!
Check out Hunt.io’s blog here: https://hunt.io/blog/php2shell-honeypot-shells-root-palo-alto-firewalls
So now that part is over with, let’s take a look, using hunt.io’s data I’ve been analysing the threat actors approach, method, tools and targets to see what defensive guidance and understanding of the TA we can get! This is based on new intel that shows a TA targeting and compromising real servers (not just honeypots this time round).
Exposures Globally
Don’t worry if we look globally at Palo Alto’s on Shodan it’s a relatively really small footprint compared to the entire volume of firewalls sold:
So who was targeted?
This is based on target IP lists and then enrichment (so country or area is just where the IP is located or estimated to be), you can see here USA are the top hitter but also Taiwan, South Korea and Japan.
So we have a range of countries, but included in the target list are a couple of USA government related IP addresses, one DoD and one in the Amazon Gov range (this could I believe be a provider or government service), so this has less of a traditional crime feel.
Threat Actor insights
This is still work in progress, there’s a lot of data, but here’s some key highlights so far:
- The operator appears to have a timezone in ASIA
- The operator appears to prompt using some Chinese
- There is clearly usage of LLMs
- The operator left open directories, think of that what you will be, that = low skill/opsec fails (low skill doesn’t mean no impact, they clearly managed to pull off some compromises, also it doesn’t mean no one in the operation had good skills… nuance is a thing!)
- There’s clear evidence of time zone, language etc. so if you were trying to be sneaky about who you are, this may not be great (but deception is also a thing)
Based on the blog there looks like a bunch of TAs using PHP2SHELL tooling (based off public PoCs), I’ve focused on the Palo Alto position because that seems to me like the key thing; when I look at the likelihood for pass exploitation last week the general theme was: unlikely mass RCE for everything running PHP, but likely to see some incidents across services with commonality e.g. appliances.
The timeline
Using data from huntio and the dream report we have the following (note this is based off two IPs data from huntio and is work in progress):
Observations so far
As with any vulnerability that may be useful to threat actors, we will probably see more incidents (that’s part of cyber security, unfortunately people get compromised every day, more often with stolen credentials/coolies/malware than software exploitation).
If you have services running vulnerable PHP on the internet, whether it’s this or another route, you will be attacked, prepare to defend yourselves! (and check logs/use an assume breach mindset etc.)
There’s lots of LLM usage here by TAs, that might help them but it also might help CTI efforts more…. both pre and post incident!
The world is not ending, well not in my lifetime anyway, and certainly not due to a CVE, but that doesn’t mean cyber is done, it never is! I’ll try and revisit this later, for more info check out the resources below:
https://hunt.io/blog/php2shell-honeypot-shells-root-palo-alto-firewalls
https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories
https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
