Researchers say one actor copied firewall configuration files and used the saved logins to walk into company networks. Here is what a config file holds, why a patch does not fix that, and what to rota...

China-linked hackers are exploiting PHP2Shell and the Fragnesia Linux kernel vulnerability to compromise firewalls, deploy persistent webshells, steal credentials, and target internal network management systems. Discover the attack chain, the risks to critical infrastructure, and the key cybersecurity lessons for defenders.

TL;DR Security researchers uncovered an espionage campaign that used a custom PHP2Shell exploit to gain root access on 25 firewall servers across the Pacific region. By pairing this PHP2Shell exploit Fragnesia privilege escalation chain into a single unauthenticated request, the attacker breached a U.S. government-affiliated network. From there, the intruder pivoted to an internal management server and extracted Active Directory credentials.

TL;DR Security researchers uncovered an espionage campaign that used a custom PHP2Shell exploit to gain root access on 25 firewall servers across the Pacific region. By pairing this PHP2Shell exploit Fragnesia privilege escalation chain into a single unauthenticated request, the attacker breached a U.S. government-affiliated network. From there, the intruder pivoted to an internal management server and extracted Active Directory credentials.

TL;DR On October 21, 2026, Cisco published seven advisories that fix 13 Snort 3 vulnerabilities across its firewall and security products. The worst, CVE-2026-20043, is a CVSS 9.0 out-of-bounds write found through internal testing. Most of the other bugs let a remote attacker crash the Snort 3 Detection Engine, causing denial of service. Why It Matters Snort 3 is the intrusion prevention engine inside many Cisco products.

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root...

TL;DR Palo Alto Networks disclosed CVE-2026-0322, a high-severity Palo Alto PAN-OS RCE flaw in the firewall management interface. Attackers are exploiting this in the wild. Rated 8.6 on the CVSS v4.0 scale, this Palo Alto PAN-OS RCE vulnerability lets authenticated attackers execute arbitrary code with root privileges. Therefore, administrators must install the latest PAN-OS maintenance updates and restrict management interface access immediately.

TL;DR WatchGuard disclosed 14 Fireware OS vulnerabilities on September 29, 2026, affecting its Firebox firewalls. The worst, CVE-2026-86131, scores CVSS 9.2 and allows remote code execution in certain VPN setups. Fixed releases include Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21. Why These Fireware OS Vulnerabilities Matter Firebox appliances guard the network edge and terminate VPN connections for many businesses. Edge devices are a favorite target, because a single foothold can open the whole network.

Learn how to choose the best firewall security manager with our comprehensive guide. Explore top solutions for centralized management, advanced threat prevention, and more.

Fintech firm Marquis links its ransomware attack to a SonicWall firewall hack and plans to seek recoupment of expenses from the firewall provider.

QKS Group a leading global advisory and research firm that empowers technology innovators and adopters. provides comprehensive data analysis and actionable insights to elevate product strategies, unde...

Cisco warned this week that two vulnerabilities, which have been exploited in zero-day attacks, are now being abused to force ASA and FTD firewalls into reboot loops.

Learn how to build the best firewall setup for small business environments. Practical, affordable solutions for protecting your office network from real-world cyber threats

SonicWall released patches for three SonicOS vulnerabilities affecting Gen 6, Gen 7, and Gen 8 firewalls, including one high-severity access control bypass and two medium-severity flaws. Customers are advised to apply the updated firmware immediately or restrict management access to SSH until patches are deployed to prevent configuration tampering or crashes....