FOFA

Headlines · 1

1. 2d
   PHP2Shell chain roots PAN-OS firewalls and targets Active Directory

   Dream Security said an apparent Chinese AI-assisted campaign chained the PHP2Shell vulnerabilities with the Fragnesia Linux privilege-escalation flaw to root 24 exposed Palo Alto Networks firewalls and an internal management server. Attackers then pivoted through a compromised US government-affiliated firewall, enumerated Active Directory, extracted credentials, and attempted actions including password spraying, backdoor account creation, and theft of a Keycloak SAML signing key. Palo Alto Networks Unit 42 independently confirmed the incident and tooling, while Dream found Claude Code, aiscan configured with DeepSeek and Kimi, and FOFA API keys; it found no direct evidence that AI wrote the exploit or scripts and did not characterize the operation as an autonomous nation-state campaign.

   Hacker News 首页（100+ 分） · 🔥 11

Experience and discussion from the community

Share my FOFA experienceAsk about FOFA