Keycloak

Headlines · 3

1. 2d
   PHP2Shell chain roots PAN-OS firewalls and targets Active Directory

   Dream Security said an apparent Chinese AI-assisted campaign chained the PHP2Shell vulnerabilities with the Fragnesia Linux privilege-escalation flaw to root 24 exposed Palo Alto Networks firewalls and an internal management server. Attackers then pivoted through a compromised US government-affiliated firewall, enumerated Active Directory, extracted credentials, and attempted actions including password spraying, backdoor account creation, and theft of a Keycloak SAML signing key. Palo Alto Networks Unit 42 independently confirmed the incident and tooling, while Dream found Claude Code, aiscan configured with DeepSeek and Kimi, and FOFA API keys; it found no direct evidence that AI wrote the exploit or scripts and did not characterize the operation as an autonomous nation-state campaign.

   Hacker News 首页（100+ 分） · 🔥 11
2. Oct 20
   AWS and Keyfactor Detail an X.509 PKI Architecture for AI Agent Identity

   AWS Machine Learning Blog presents a reference architecture that combines Keyfactor EJBCA with AWS services to authenticate AI agents, verify user delegation and enforce revocation across MCP tool calls. Its example uses Amazon Bedrock, the AWS Strands Agents SDK and FastMCP, with signed request envelopes, RFC 8693 audience-scoped tokens, OCSP checks and identity cross-validation. The post says it also provides complete example source code.

   AWS Machine Learning Blog · 🔥 0
3. Oct 20
   Taiwan Government Attack Used Near-Autonomous AI Agents, Report Says

   iThome reported that foreign hackers used an AI attack system built on Hermes and OpenClaw agent frameworks in a hybrid attack against Taiwan government agencies in early July 2026. Taiwan’s Ministry of Digital Development said government cybersecurity monitoring detected the anomalous attack in July and that the attackers combined AI agents with other methods. According to Dream Security’s reconstruction from 1,395 work files, the operation lasted less than four days and involved 12 attack waves, with up to eight agents deployed in a single wave. The company said the system cracked 85 sets of government personnel credentials and obtained at least 2,564 personnel records. Dream Security described the operation as near-autonomous, meaning it was not fully autonomous or necessarily free of human involvement. The attacker’s identity and state affiliation were not established.

   iThome 台湾 · 🔥 0

Experience and discussion from the community

Share my Keycloak experienceAsk about Keycloak