Dream Security

Headlines · 2

1. 2d
   PHP2Shell chain roots PAN-OS firewalls and targets Active Directory

   Dream Security said an apparent Chinese AI-assisted campaign chained the PHP2Shell vulnerabilities with the Fragnesia Linux privilege-escalation flaw to root 24 exposed Palo Alto Networks firewalls and an internal management server. Attackers then pivoted through a compromised US government-affiliated firewall, enumerated Active Directory, extracted credentials, and attempted actions including password spraying, backdoor account creation, and theft of a Keycloak SAML signing key. Palo Alto Networks Unit 42 independently confirmed the incident and tooling, while Dream found Claude Code, aiscan configured with DeepSeek and Kimi, and FOFA API keys; it found no direct evidence that AI wrote the exploit or scripts and did not characterize the operation as an autonomous nation-state campaign.

   Hacker News 首页（100+ 分） · 🔥 11
2. Oct 20
   Taiwan Government Attack Used Near-Autonomous AI Agents, Report Says

   iThome reported that foreign hackers used an AI attack system built on Hermes and OpenClaw agent frameworks in a hybrid attack against Taiwan government agencies in early July 2026. Taiwan’s Ministry of Digital Development said government cybersecurity monitoring detected the anomalous attack in July and that the attackers combined AI agents with other methods. According to Dream Security’s reconstruction from 1,395 work files, the operation lasted less than four days and involved 12 attack waves, with up to eight agents deployed in a single wave. The company said the system cracked 85 sets of government personnel credentials and obtained at least 2,564 personnel records. Dream Security described the operation as near-autonomous, meaning it was not fully autonomous or necessarily free of human involvement. The attacker’s identity and state affiliation were not established.

   iThome 台湾 · 🔥 0

Experience and discussion from the community

Share my Dream Security experienceAsk about Dream Security