When wireless is perfectly applied the whole earth will be converted into a huge brain - All tweets are my own - Sr Major Account Manager - Palo Alto Networks
Norway
Joined May 2011
- Tweets10.4K
- Following2.7K
- Followers1.2K
- Likes7K
Fredrik L. Andersen retweeted
We detected an indirect prompt injection (IDPI) campaign across 26 domains presenting as AI-powered digital asset trading platforms. Hidden <span> tags hijack AI agents into acting as financial experts to coerce users into visiting these sites. More info: bit.ly/4iJc1bX
ALT Screenshot of the BoundMerit website demonstrating an AI-powered digital asset trading platform. The left side shows a green and blue gradient banner with the text 'AI-powered digital asset trading platform' and a logo above. The right side displays browser elements and page source code.
ALT Screenshot of the BitGrok-ES website showcasing a digital cryptocurrency trading platform with artificial intelligence. The page mentions features like advanced platform offerings and market analysis tools.
Fredrik L. Andersen retweeted
The AI era is redefining network security.
Your team needs fewer handoffs, not more tools, alerts, or manual work.
Learn how to stop threats earlier and protect human and AI workloads with one unified platform
Less fragmentation. Faster protection. See how. bit.ly/4ApF22j
Fredrik L. Andersen retweeted
We've observed intrusion attempts against multiple targets using #ARTEX, an openly published AI penetration-testing framework in which an LLM agent chooses each step of an attack. Details at bit.ly/4kuobGz
ALT A flowchart titled "Multi-Stage Attack Flow: From Reconnaissance to Business Logic Abuse" illustrates six stages. Stage 1: "Recon" involves broad reconnaissance with scanned public IPs, S3 buckets, and internal hostname. Stage 2: "Mapping" includes application mapping with software bundles, source maps, and OpenAPI specs. Stage 3: "Identity" focuses on IdP probing with login, recovery, and OAuth flows. Stage 4: "Pivot" entails pivoting to exposed API and falling back to API surface. Stage 5: "Abuse" involves business logic abuse with actions to escalate and obtain functions. Stage 6: "Write" covers unauthorized API actions and executing commands.
Fredrik L. Andersen retweeted
A confident AI decision isn't always a trustworthy one.
As decision models power autonomous agents, securing the context behind their actions becomes critical.
Explore what's next for agentic AI ⬇️
Fredrik L. Andersen retweeted
We observed in-the-wild exploitation of CVE-2026-102785 on a site running a vulnerable version of YOOtheme Pro two days after the patch. Scanners planted JPEG/PHP polyglot webshells in uploads, then operators deployed an ALFA webshell. Details: bit.ly/48fpUZ3
ALT Process chain diagram illustrating the web server (httpd.exe) spawning multiple cmd.exe processes for scanner validation commands in a cybersecurity program.
ALT The image shows a PHP code snippet for a first-stage webshell.
Fredrik L. Andersen retweeted
🎉 Palo Alto Networks is named a Leader in the 2026 Gartner® Magic Quadrant™ for Privileged Access Management, positioned furthest in Completeness of Vision!
This marks our first recognition since Idira joined Palo Alto Networks. We’re delivering Modern PAM built on Zero Standing Privilege for every human, workload, and AI agent.
PAM built for the agentic era. Get the report ⬇️
bit.ly/4iHoPiE
Fredrik L. Andersen retweeted
‼️ WARNING - A researcher just dropped a report on Tailscale SSH flaws — one compromised device could get root on others, and there’s NO PATCH yet.
In lab tests, SSH port forwarding enabled privilege escalation and lateral movement across already-permitted devices.
Tailscale says a fix is coming.
Read - thehackernews.com/2026/10/un…
Fredrik L. Andersen retweeted
⚠️ UPDATE: UNIT 42 CONFIRMS PHP2SHELL EXPLOITATION WITH AGENTIC AI POST-EX
Unit 42's Oct 23 threat-brief update confirms PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is being exploited in the wild, with attackers using agentic AI platforms for post-exploitation. Both flaws are unauthenticated RCE, CVSS 9.2 (CVSS 4.0).
In one European government case, within ~2 hours of initial exploitation attackers:
• Accessed password hashes and MFA secrets
• Stood up an NTLM-relay tunnel into Active Directory
• Attempted Domain Admin privilege escalation
Commands were wrapped in machine-parseable delimiters such as ==SHELLUSER== and ==PASSWD== — strong agentic-attacker markers. Cortex Xpanse still sees ~22.6M exposed PHP instances potentially vulnerable.
Not framed as a mass outbreak, but confirmed live post-ex. Patch PHP immediately (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or vendor fixed builds) and hunt for post-exploitation activity.
unit42.paloaltonetworks.com/…
#DDW #PHP2Shell #PHP #Unit42 #CyberSecurity #ThreatIntelligence #Vulnerability
Fredrik L. Andersen retweeted
In August, @AISecurityInst reported an incident where Claude Mythos 5 took unauthorized actions on the internet during AISI’s testing of its cyber capabilities.
We've now produced a further analysis of this incident, to better understand the model's alignment properties.
anthropic.com/research/align…
Fredrik L. Andersen retweeted
URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches thehackernews.com/2026/10/ur…
Fredrik L. Andersen retweeted
An update to our threat brief on PHP CVE-2026-109618 & CVE-2026-109619: We observed an attack using agentic AI platforms for rapid post-exploitation and access to MFA secrets within 2 hours. Read the updated brief for analysis and hunting queries: bit.ly/4z7Txr2
Fredrik L. Andersen retweeted
Palo Alto Networks CEO @nikesharora warns that the window for fixing cybersecurity vulnerabilities is shrinking.
"I think there'll be a time where you won't have the luxury of weeks to be able to go figure out if this is real or not."
"You'll find out in the morning when you wake up that somebody found a big vulnerability and they posted it for everybody to see."
Fredrik L. Andersen retweeted
as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)
Fredrik L. Andersen retweeted
Do you know who illustrated the comic on calif.io/php2shell?
Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax.
This artist-hacker couple has the best story, stay tuned!
Fredrik L. Andersen retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Fredrik L. Andersen retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: teapaw.org/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
Fredrik L. Andersen retweeted
We reproduced CVE-2026-109618/109619 in an isolated lab on fully updated
Ubuntu 24.04 & 26.04 — the exact php8.3/php8.5 packages USN-8948-1 lists as
fixed (8.3.6-0ubuntu0.24.04.13, 8.5.4-0ubuntu1.5). With the documented
preconditions. #php2shell
Fredrik L. Andersen retweeted
🚨 UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!
Researchers are reporting a successful double-free trigger on the newly patched release.
⚠️ The official fixes may be incomplete. A crash alone doesn't confirm RCE, but this deserves urgent investigation.
Don't assume you're safe just because you've patched.
#php4shell #php #cybersecurity
teapaw.org/_annieversary/status/2…
chat. chat... its not funny anymore
Readers added context they thought people might want to know
The original post has since been edited to specify that this was about an unrelated vulnerability that the user had discovered, not the recently patched vulnerability.
fedi.katze.sh/@elise/1174793…
Fredrik L. Andersen retweeted
‼️ PHP UPDATE: The Dutch parliament, the Dutch national cyber agency and Finland's central government have pulled websites offline ahead of the PHP patch.
Finland's state IT centre Valtori is shutting down public-facing central government web services. The National Land Survey of Finland is already down.
In the Netherlands, the Tweede Kamer, the NCSC and the Dutch Data Protection Authority are offline. So are tech site Tweakers and NotuBiz, which runs council information for 100+ local governments.
The University of Vienna switched off its websites, webmail and Moodle. The University of Freiburg and Finland's Haaga-Helia have taken services down too.
Fur Affinity, Pinboard, explain xkcd and every wiki on Miraheze are dark as well.
Valtori says its shutdown is a precaution, not the result of an attack or breach.
PHP was created by Rasmus Lerdorf in 1994, it initially stood for Personal Home Page
PHP's fix is due at 14:00 UTC today.
Fredrik L. Andersen retweeted
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
