When wireless is perfectly applied the whole earth will be converted into a huge brain - All tweets are my own - Sr Major Account Manager - Palo Alto Networks
Norway
Joined May 2011
- Tweets10.4K
- Following2.7K
- Followers1.2K
- Likes7K
Fredrik L. Andersen retweeted
We observed in-the-wild exploitation of CVE-2026-102785 on a site running a vulnerable version of YOOtheme Pro two days after the patch. Scanners planted JPEG/PHP polyglot webshells in uploads, then operators deployed an ALFA webshell. Details: bit.ly/48fpUZ3
ALT Process chain diagram illustrating the web server (httpd.exe) spawning multiple cmd.exe processes for scanner validation commands in a cybersecurity program.
ALT The image shows a PHP code snippet for a first-stage webshell.
Fredrik L. Andersen retweeted
🎉 Palo Alto Networks is named a Leader in the 2026 Gartner® Magic Quadrant™ for Privileged Access Management, positioned furthest in Completeness of Vision!
This marks our first recognition since Idira joined Palo Alto Networks. We’re delivering Modern PAM built on Zero Standing Privilege for every human, workload, and AI agent.
PAM built for the agentic era. Get the report ⬇️
bit.ly/4iHoPiE
Fredrik L. Andersen retweeted
‼️ WARNING - A researcher just dropped a report on Tailscale SSH flaws — one compromised device could get root on others, and there’s NO PATCH yet.
In lab tests, SSH port forwarding enabled privilege escalation and lateral movement across already-permitted devices.
Tailscale says a fix is coming.
Read - thehackernews.com/2026/10/un…
Fredrik L. Andersen retweeted
⚠️ UPDATE: UNIT 42 CONFIRMS PHP2SHELL EXPLOITATION WITH AGENTIC AI POST-EX
Unit 42's Oct 23 threat-brief update confirms PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is being exploited in the wild, with attackers using agentic AI platforms for post-exploitation. Both flaws are unauthenticated RCE, CVSS 9.2 (CVSS 4.0).
In one European government case, within ~2 hours of initial exploitation attackers:
• Accessed password hashes and MFA secrets
• Stood up an NTLM-relay tunnel into Active Directory
• Attempted Domain Admin privilege escalation
Commands were wrapped in machine-parseable delimiters such as ==SHELLUSER== and ==PASSWD== — strong agentic-attacker markers. Cortex Xpanse still sees ~22.6M exposed PHP instances potentially vulnerable.
Not framed as a mass outbreak, but confirmed live post-ex. Patch PHP immediately (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or vendor fixed builds) and hunt for post-exploitation activity.
unit42.paloaltonetworks.com/…
#DDW #PHP2Shell #PHP #Unit42 #CyberSecurity #ThreatIntelligence #Vulnerability
Fredrik L. Andersen retweeted
In August, @AISecurityInst reported an incident where Claude Mythos 5 took unauthorized actions on the internet during AISI’s testing of its cyber capabilities.
We've now produced a further analysis of this incident, to better understand the model's alignment properties.
anthropic.com/research/align…
Fredrik L. Andersen retweeted
URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches thehackernews.com/2026/10/ur…
Fredrik L. Andersen retweeted
An update to our threat brief on PHP CVE-2026-109618 & CVE-2026-109619: We observed an attack using agentic AI platforms for rapid post-exploitation and access to MFA secrets within 2 hours. Read the updated brief for analysis and hunting queries: bit.ly/4z7Txr2
Fredrik L. Andersen retweeted
Palo Alto Networks CEO @nikesharora warns that the window for fixing cybersecurity vulnerabilities is shrinking.
"I think there'll be a time where you won't have the luxury of weeks to be able to go figure out if this is real or not."
"You'll find out in the morning when you wake up that somebody found a big vulnerability and they posted it for everybody to see."
Fredrik L. Andersen retweeted
as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)
Fredrik L. Andersen retweeted
Do you know who illustrated the comic on calif.io/php2shell?
Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax.
This artist-hacker couple has the best story, stay tuned!
Fredrik L. Andersen retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Fredrik L. Andersen retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
Fredrik L. Andersen retweeted
We reproduced CVE-2026-109618/109619 in an isolated lab on fully updated
Ubuntu 24.04 & 26.04 — the exact php8.3/php8.5 packages USN-8948-1 lists as
fixed (8.3.6-0ubuntu0.24.04.13, 8.5.4-0ubuntu1.5). With the documented
preconditions. #php2shell
Fredrik L. Andersen retweeted
🚨 UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!
Researchers are reporting a successful double-free trigger on the newly patched release.
⚠️ The official fixes may be incomplete. A crash alone doesn't confirm RCE, but this deserves urgent investigation.
Don't assume you're safe just because you've patched.
#php4shell #php #cybersecurity
xitter.cf/_annieversary/status/2…
chat. chat... its not funny anymore
Readers added context they thought people might want to know
The original post has since been edited to specify that this was about an unrelated vulnerability that the user had discovered, not the recently patched vulnerability.
fedi.katze.sh/@elise/1174793…
Fredrik L. Andersen retweeted
‼️ PHP UPDATE: The Dutch parliament, the Dutch national cyber agency and Finland's central government have pulled websites offline ahead of the PHP patch.
Finland's state IT centre Valtori is shutting down public-facing central government web services. The National Land Survey of Finland is already down.
In the Netherlands, the Tweede Kamer, the NCSC and the Dutch Data Protection Authority are offline. So are tech site Tweakers and NotuBiz, which runs council information for 100+ local governments.
The University of Vienna switched off its websites, webmail and Moodle. The University of Freiburg and Finland's Haaga-Helia have taken services down too.
Fur Affinity, Pinboard, explain xkcd and every wiki on Miraheze are dark as well.
Valtori says its shutdown is a precaution, not the result of an attack or breach.
PHP was created by Rasmus Lerdorf in 1994, it initially stood for Personal Home Page
PHP's fix is due at 14:00 UTC today.
Fredrik L. Andersen retweeted
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
Fredrik L. Andersen retweeted
When AI agents execute workflows, enterprise risk expands.
How do you scale agent capabilities while keeping data protected?
Prisma AIRS integrates with @AnthropicAI's Claude Enterprise to enforce clear security boundaries, protect sensitive data, and reduce breach risk.
Learn how to govern agentic AI with confidence 🎯
bit.ly/4jtNDMd
Fredrik L. Andersen retweeted
🇺🇦 It’s not easy to work in Ukraine today — but thanks to you, our friends, our team keeps going
Every U-SHIRT you choose supports real Ukrainian women who make our clothing by hand
It’s your statement of solidarity with Ukraine
Wear symbols of freedom!
Fredrik L. Andersen retweeted
AI is changing the balance between attackers and defenders, enabling threats to move at unprecedented speed and scale.
@NikeshArora discusses what this means for the future of cybersecurity in @Fortune ⬇️
bit.ly/4z16ena
Fredrik L. Andersen retweeted
‼️ Three zero-days. Root commands. No login.
An attacker exploited the flaws in a fully patched Ivanti Connect Secure VPN and stole stored credentials.
Ivanti confirms exploitation in the wild. Two flaws patched; a fix for the third is pending.
Read: thehackernews.com/2026/10/at…
