CJ Moses

New Capabilities

Said PHP2Shell is now broadly exploited in the wild and that attacks predate the patch

Palo Alto Networks confirmed that attackers chained the PHP2Shell flaws with a Linux kernel bug to take root control of its firewalls, and shipped hotfixes for PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2. Unit 42, the company's threat research arm, said it independently verified the tooling and results that Dream Security described.

Updated Nov 1

Force in Play

As of May 2026: Led Amazon's threat intelligence disclosure and customer notification

From 2021 to 2025, Amazon exposed that Sandworm (GRU Unit 74455)—the team behind NotPetya and Ukraine's grid attacks—had shifted to infiltrating misconfigured devices at Western utilities, energy companies, and security providers. They compromised edge devices, harvested credentials, and penetrated networks across North America and Europe.

Updated May 16