Strategic PartnersIssue 018 records
Palo Alto Networks
The first Palo Alto Networks edition is dominated by the firewall management interface. Dream Research documented a custom PHP2Shell and Linux kernel exploit chain that rooted 24 internet-exposed PAN-OS firewalls and a management server, then reached a US government-affiliated Active Directory; Palo Alto Networks and Unit 42 confirmed exploitation and put impact at about 0.02% of its base, all with exposed management. CISA had already listed a separate PAN-OS management flaw as exploited on Oct. 14. Unit 42 also retracted an earlier European government claim. On the AI side, Prisma AIRS added a FedRAMP Moderate option at a 15% surcharge, while a new preprint shows prompt-injection detector benchmarks predict little. Jordan School District and Unit 42’s university case add K-12 and higher-ed signals.
- Evidence records
- 8
- Cross-source patterns
- 2
- Evidence classes
- 4 vendor claim1 independent research1 government evaluation1 government audit1 academic research
- Outcomes
- 5 cautionary2 emerging1 mixed
- Source freshness
- 3 new this fortnight3 recent2 undated
- Research completed
- 2026-10-30
Choose a role to see its takeaway beside every record in the ledger.
Patterns across the evidence
Synthesis · Lighthouse Advisory interpretation
Two separately exploited PAN-OS flaws this month both run through the firewall management interface, so exposure of that interface, not the product itself, decides who is at risk
CISA listed CVE-2026-0322, an authenticated management-interface flaw, as exploited on Oct. 14. Two weeks later Dream documented an unauthenticated PHP2Shell plus kernel chain that rooted 24 exposed PAN-OS firewalls and a management server and reached a US government-affiliated directory. The vendor advisory and Unit 42 confirm exploitation and put the impacted share at about 0.02% of the installed base, all with management reachable from the internet. For state, local and education networks the actionable control is the same in every source: keep management off the internet, upgrade to fixed builds and check for compromise before closing the ticket. New purchases, such as Jordan School District’s firewall refresh, should start from that baseline.
Operating questionCan the agency show, from an outside scan this week, that no PAN-OS management interface or Panorama is reachable from the internet, and has every previously exposed device been hunted for webshells and tunnels?
Supporting evidenceDream (Dream Research team)Palo Alto Networks Product SecurityCybersecurity and Infrastructure Security Agency (CISA)Unit 42 PHP2Shell threat brief, Oct. 29 update: independently verified the PAN-OS exploit chain, says about 0.02% of its installed base had exposed management and was impacted, after retracting an Oct. 23 claim about a European government intrusion
AI security claims, whether threat intelligence or guardrail effectiveness, are moving faster than their evidence and need verification on the agency’s own data
Unit 42 retracted an Oct. 23 account of agentic AI post-exploitation at a European government within two days, while its Oct. 29 update independently verified another researcher’s results. An October preprint found prompt-injection detector benchmark scores barely predict performance inside agents, with false-positive rates from none to over 90%. Palo Alto Networks’ own October Prisma AIRS notes claim FedRAMP-boundary guardrail parity without any efficacy data. Agencies buying or citing AI security should track revisions, test guardrails on their own tool outputs at low false-positive rates, and treat vendor numbers as unverified until measured.
Operating questionBefore adopting an AI guardrail or acting on an AI-attack claim, what agency-side test or second source will confirm it?
Supporting evidenceUnit 42 PHP2Shell threat brief, Oct. 29 update: independently verified the PAN-OS exploit chain, says about 0.02% of its installed base had exposed management and was impacted, after retracting an Oct. 23 claim about a European government intrusionAcademic authors (arXiv preprint 2610.03448)Palo Alto Networks (Prisma AIRS)
Evidence ledger
Full record · every source keeps its link and limitations
Dream Research: custom PHP2Shell plus Fragnesia exploit chain rooted 25 internet-exposed PAN-OS firewall and management servers, then pivoted into a US government-affiliated Active Directory
Dream reports recovering a full attack kit: a custom, non-public PHP2Shell exploit (CVE-2026-109618/109619) tailored to the PAN-OS management web server, chained with the Fragnesia Linux kernel privilege escalation (CVE-2026-46300) to get root from one unauthenticated HTTPS request in under 15 minutes. The attacker used FOFA to find about 19,000 internet-facing PAN-OS management interfaces, about 5,000 answered a version scan, 240 were filtered to the US, Japan, Taiwan and South Korea on PAN-OS 12.1/12.2, and 24 firewalls were rooted with a webshell. Two belonged to a US government-affiliated organization (CAC authentication, government-style naming); from the second, the attacker tunneled in, rooted the internal firewall management server (25th server), decrypted the LDAP service account password and ran LDAP enumeration and password spraying against a domain with no lockout. Dream says the tunnel is likely still active. It saw AI tooling (aiscan configured with DeepSeek and Kimi) but no direct evidence AI wrote the exploit, and says it was not a fully autonomous attack.
Why it matters, evidence and limitations
- Why it matters
- State, county, city and campus networks run large PAN-OS estates; any agency that exposes the firewall management interface to the internet is in the targeted population, and the reported pivot path (firewall to central management server to Active Directory) is the same one a public-sector network would present.
- Evidence and measured results
- Opened and read the Dream Research post in full: exploit stages, version profiles, campaign funnel figures, timeline and post-exploitation steps. Corroborated by Unit 42’s Oct. 29 update stating it independently verified the attacker’s tooling and results, and by The Register’s Oct. 29 report.
- Limitations and uncertainty
- Single private researcher’s account based on recovered artifacts; the government organization is unnamed and its level (federal, state or local) is not stated. Attribution to Chinese state-aligned actors is Dream’s inference from targeting. Dream sells an autonomous research product used in this hunt. Counts are from attacker artifacts, not a census.
Palo Alto Networks security advisory: PHP2Shell (CVE-2026-109618/109619) affects PAN-OS management interfaces, active exploitation observed, fixed builds and Threat Prevention signatures listed
Palo Alto Networks states the PHP2Shell flaws apply to PAN-OS on PA-Series and VM-Series firewalls and Panorama, need no special configuration, and carry CVSS 4.0 9.2 when the management interface is reachable from the internet, dropping when access is restricted to a jump box. It states active exploitation has been observed against internet-exposed management interfaces. The advisory lists fixed hotfix builds for PAN-OS 10.2, 11.1, 11.2 and 12.1 lines, says Cortex XCORE SaaS and WildFire Cloud were previously impacted and patched on Oct. 21 and Oct. 22, and lists Threat Prevention signature IDs (including 543004, released Oct. 20 for Frontier Virtual Patching customers) with a requirement to route management traffic through a data-plane interface for the signatures to apply.
Why it matters, evidence and limitations
- Why it matters
- This is the authoritative fix list public-sector network teams will patch against; the signature workaround only works if management traffic is routed through a data-plane port, which many smaller agencies will not have configured.
- Evidence and measured results
- Opened and read the advisory page, including the product status table, severity variants, exploitation status, fixed-version table and workaround section.
- Limitations and uncertainty
- Vendor self-assessment; the page is live and changes, and the exact fixed-version list read tonight may be revised. Page shows no single publication date in extracted text.
Unit 42 PHP2Shell threat brief, Oct. 29 update: independently verified the PAN-OS exploit chain, says about 0.02% of its installed base had exposed management and was impacted, after retracting an Oct. 23 claim about a European government intrusion
Unit 42’s Oct. 29 update says PHP2Shell is being actively exploited against internet-exposed PAN-OS management interfaces, that it independently verified Dream’s reported attacker tooling and results, that patched customers are not affected, and that about 0.02% of its global installed base had internet-facing management configured and was impacted, with each contacted. Cortex Xpanse counted over 22.6 million exposed instances potentially vulnerable to PHP2Shell overall. The same page records that on Oct. 25 Unit 42 retracted its Oct. 23 update describing agentic AI post-exploitation at a European government agency, saying it cannot confirm initial access used the PHP2Shell CVEs. The brief also publishes XQL hunting queries, noting they are not specific to these CVEs and may produce false positives.
Why it matters, evidence and limitations
- Why it matters
- Public-sector buyers rely on vendor threat intelligence to prioritise; this page shows both a useful verified finding and a retracted high-profile claim within one week, which matters for how agencies weigh vendor briefs.
- Evidence and measured results
- Opened and read the full threat brief, including the executive summary, Oct. 29 update, protections list, hunting queries notes, update log and Oct. 25 retraction text.
- Limitations and uncertainty
- Vendor-authored with commercial interest; the 0.02% and 22.6 million figures are unaudited telemetry. The retracted Oct. 23 content is not reproduced and should not be cited as fact.
CISA adds PAN-OS CVE-2026-0322 management-interface code injection to the Known Exploited Vulnerabilities catalog
On Oct. 14, 2026 CISA added CVE-2026-0322, a Palo Alto Networks PAN-OS code injection vulnerability, to the KEV catalog based on evidence of active exploitation, alongside Cisco and Ahsay flaws. The alert notes BOD 26-04 requires federal civilian agencies to prioritise KEV items on exposed assets that grant total control and sets expectations for checking whether systems were compromised before patching. The vendor advisory describes CVE-2026-0322 as an authenticated root code execution flaw in the PAN-OS management interface; press reports cite an Oct. 17 federal deadline.
Why it matters, evidence and limitations
- Why it matters
- Two distinct exploited PAN-OS management-interface flaws in one month (this one and PHP2Shell) make management-plane exposure the dominant Palo Alto risk for state and local networks; KEV is binding only on federal agencies but is widely adopted by states as a patch priority list.
- Evidence and measured results
- Opened and read the CISA alert in full. Read the vendor advisory for CVE-2026-0322 and a CSO Online report for context on the deadline and affected products.
- Limitations and uncertainty
- Federal directive does not bind state, local or education entities. The alert itself lists the CVE without technical detail; details come from the vendor advisory.
Prisma AIRS October 2026 release notes: AI Runtime Security API Intercept available in FedRAMP Moderate with a 15% credit surcharge, inline inspection of streamed LLM responses, and AI red-teaming client without Kubernetes
Palo Alto Networks documents that AI Runtime Security (API Intercept) now runs in FedRAMP Moderate environments with stated functional parity: prompt injection defense, DLP, toxic content filtering, malicious code and URL blocking, contextual grounding and SQL guardrails. Selecting FedRAMP Moderate in a deployment profile provisions it in certified infrastructure and applies a standard 15% Flex Credit surcharge, with connected services such as Strata Cloud Manager, Panorama, logging, DLP and WildFire inside the boundary. Other October features include inline inspection of streamed LLM responses through the firewall, a standalone binary and Docker Compose option for the AI Red Teaming network channel client, and CLARA-driven migration of AWS and Azure native firewall policies.
Why it matters, evidence and limitations
- Why it matters
- State agencies and universities that require FedRAMP or StateRAMP-aligned services for AI applications now have a documented government-boundary option for LLM guardrails, with a clear price premium to budget.
- Evidence and measured results
- Opened and read the October 2026 new-features page in full.
- Limitations and uncertainty
- Vendor documentation with no performance data, customer examples or authorization package details. FedRAMP is federal; state recognition varies.
Jordan School District (Utah) summary of award: Palo Alto network security firewall replacement at JATC South to lowest responsive bidder at $268,232, with nine bids ranging to $548,136
Jordan School District’s Information Systems department recommended awarding contract 27TH07 for a Palo Alto network security firewall at the JATC South data server room to CompuNet at $268,232.30, the lowest responsive and responsible of nine bids. Other bids ranged from $401,389.44 to $548,136.20. The purchase is funded from the Information Systems equipment budget, and bid pricing expires Nov. 30, 2026.
Why it matters, evidence and limitations
- Why it matters
- A current, primary K-12 record showing Palo Alto firewall refreshes are bought brand-specified through competitive low bid, with wide reseller price spreads that matter to district budgets.
- Evidence and measured results
- Opened the one-page Summary of Award PDF and read it in full.
- Limitations and uncertainty
- Award summary only: no model, quantity, subscription, term or AI feature detail; board approval outcome not shown in this document.
Passing the Test You Trained On: re-evaluating 15 prompt-injection detectors on agent tool outputs finds benchmark rankings transfer poorly and false-positive rates range from none to over 90%
The authors replay ground-truth tool calls from AgentDojo and tau-bench to get benign-by-construction tool outputs, label injected outputs by differential replay, and test 15 open detectors (including Meta Prompt Guard 2) plus two task-aware LLM judges, also on BIPIA. Rankings barely transfer: Kendall tau is 0.01 between BIPIA and AgentDojo and 0.28 between the two agent benchmarks. PIGuard catches 95.1% of BIPIA injections at 1% FPR but 2.1% on AgentDojo; one detector catching 72.2% on AgentDojo catches 15.2% on tau-bench. False-positive rates on tool outputs range from none to over 90% and are consistent across agent benchmarks. Training-input form, not attack-string overlap, explains results; every approach misses classes of injections outside its training distribution. The authors recommend evaluating on the agent’s own tool outputs at low FPR and auditing training data.
Why it matters, evidence and limitations
- Why it matters
- Agencies evaluating AI runtime guardrails, including Prisma AIRS prompt-injection defense, should not rely on vendor or public benchmark scores; they need tests on their own agent traffic.
- Evidence and measured results
- Opened the arXiv HTML and read the abstract, introduction, methods, results and limitations. Code is published for reproduction.
- Limitations and uncertainty
- Preprint, not peer reviewed. Commercial API detectors, including Prisma AIRS, were not tested; relevance to any specific product is by analogy only.
Unit 42: low-skill actor BUGSTER used an AI agent framework with safety controls disabled to brute-force one Indian university site and exfiltrate more than 5,200 records from another
Unit 42 describes an actor, BUGSTER, who configured the Hermes Agent framework with DeepSeek V4 and the Cursor IDE, with safety controls disabled, and relied on AI-generated scripts and reconnaissance reports. Against one Indian university’s online education platform, the actor enumerated 12 subdomains, extracted 13 user IDs via the WordPress REST API around a WAF, generated a brute-force tool with 117 usernames and 28 passwords, and found one valid login. At a second public university, an administrator account with a weak password led to exfiltration of a MongoDB database with more than 5,200 student and faculty records containing PII. Unit 42 assesses the actor lacked the skills for this before AI tools.
Why it matters, evidence and limitations
- Why it matters
- University LMS, student portals and WordPress sites in the US share the same weaknesses (exposed user enumeration, weak admin passwords); AI lowers the skill needed to exploit them.
- Evidence and measured results
- Opened and read the Unit 42 post in full, including the attack stages and the exfiltration manifest description.
- Limitations and uncertainty
- Vendor research; victims are in India and unnamed; US transferability is by analogy. The actor’s identity is unknown and the count of similar actors is not given.
How to read this edition
Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.
- Vendor claim
- A supplier-provided assertion that has not been upgraded to independent evidence.
- Independent research
- Research conducted outside the implementing organization.
- Government evaluation
- A public body’s measured evaluation or documented pilot.
- Government audit
- An oversight review of performance, controls, or operations.
- Academic research
- Research produced through an academic institution or peer-reviewed venue.