Attackers are using newly fixed flaws that affect Cisco firewalls and Palo Alto firewall admin pages. Here is what that means for your business and what to do.
AppWT Informative Multi-Lingual System
Attackers are going after the firewalls and VPN devices that guard many business networks. Cisco and Palo Alto Networks both confirmed this week that attackers are using flaws that both companies have now fixed. If your office uses either brand, ask whoever runs your network to install the updates today. Also make sure the device's admin page cannot be reached from the open internet.
What is happening
A firewall is a device that sits between your office network and the internet. It decides what traffic gets in. Many firewalls also run a VPN. A VPN is a secure tunnel that lets staff connect to the office from home.
These devices face the internet, so attackers look for weak spots in them. Several reports this week point to the same kind of problem.
- Cisco firewalls. Cisco released fixes for a flaw in its Secure Firewall ASA and FTD software. Cisco said attackers have used the flaw in real attacks, according to The Hacker News.
- Palo Alto Networks firewalls. The company warned that attackers are using flaws called PHP2Shell against admin pages that can be reached from the internet, as The Hacker News reported.
- Cisco SD-WAN systems. SD-WAN is a way to link many office sites together. Cisco Talos said hackers used a flaw, fixed in February, to plant malware that copies the keys used to protect traffic between sites, per this report. Talos calls those attacks historical.
How the attacks work
None of these attacks need a password. That is what makes them serious.
The Cisco VPN flaw
This flaw is in the VPN service. An attacker sends a specially built request while connecting to the VPN. The device then restarts without warning. While it restarts, staff cannot connect. Cisco said a successful VPN login is not needed to reach the weak spot.
The flaw is rated 8.6 out of 10 on CVSS, a common scale for how serious a flaw is. It applies when a setting called secondary authentication is turned on. Cisco did not say who is behind the attacks, when they began or how widespread they are.
The Palo Alto PHP2Shell flaws
PHP is common software used to build web pages, including the admin pages on many devices. The PHP2Shell flaws are rated 9.2 out of 10. They can let an attacker run their own commands on a system without logging in. The PHP Foundation fixed them on October 21, 2026.
Researchers at a security company called Dream said a suspected attacker linked to China paired these flaws with a Linux bug called Fragnesia. Together, they gave the attacker full control, called "root," of 25 servers in the United States, Japan, Taiwan and South Korea. The attacker then stole login details from the connected networks. Dream did not name the firewall maker, as Help Net Security notes.
Security researcher Kevin Beaumont said he is aware of a ransomware group using PHP2Shell against Palo Alto firewalls to get into organizations. Ransomware is malware that locks files and demands payment.
Who is at risk
Most families do not own these devices. The risk is mainly for businesses, schools, clinics and offices that use Cisco or Palo Alto firewalls.
Palo Alto Networks said the risk is highest when the admin page can be reached from outside addresses on the internet. It said less than .01% of its customers have it set up that way. It also said customers who installed the fixes, or who keep the admin page off the internet, are not affected.
For Cisco, the VPN flaw matters if your device uses secondary authentication in its VPN settings.
The US Cybersecurity and Infrastructure Security Agency, or CISA, added Fragnesia to its list of flaws known to be used in attacks. It told federal agencies to fix it by October 31, 2026.
What to do now
If you own a small business, you may not manage the firewall yourself. Send this list to the person or company that does.
- Find out what you have. Ask which firewall brand and software version your office uses.
- Install the updates. Cisco has fixed versions of its ASA and FTD software. Palo Alto Networks has patches for its PAN-OS software and listed other steps for versions still waiting on a fix.
- Keep the admin page private. Palo Alto Networks recommends allowing access to the admin page only from trusted internal addresses.
- Use Cisco's short-term fix if you cannot update yet. Cisco suggests turning off secondary authentication on the VPN groups that use it. In some setups, it suggests turning off the tunnel group list instead.
- Update PHP on your own servers. If you run websites or servers that use PHP, the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
If you think you were hit
An update closes the door. It does not remove someone who already got in. Ask your network helper to take these steps.
- Look for sudden restarts. With the Cisco flaw, an attack makes the device reload without warning. Check the device records for restarts no one can explain.
- Search for signs of a break-in. For Fragnesia, CISA added a forensic triage requirement for federal agencies. That means a careful search for signs that an attacker got inside.
- Change admin and network passwords. In the attacks Dream described, the attacker took login details after getting in.
Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.
Sources
- Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls, The Hacker News, 2026-10-29
- Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces, The Hacker News, 2026-10-29
- Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys, The Hacker News, 2026-10-29
- Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls, Help Net Security, 2026-10-29
Tags
Frequently Asked Questions
Do I need to worry about this at home?
Most families do not use these devices. The attacks target Cisco and Palo Alto firewalls used by businesses and other organizations.
What does the Cisco VPN flaw do?
An attacker can send a special request to the VPN and make the firewall restart without warning. No login is needed. While it restarts, staff cannot connect.
Am I safe if my Palo Alto firewall is updated?
Palo Alto Networks said customers who applied the available patches are not affected. It said customers who keep the admin page off the public internet are also not affected.
What is PHP2Shell?
PHP2Shell is the name for two flaws in PHP, common software used to build web pages. They can let an attacker run commands on a system without logging in. The PHP Foundation fixed them on October 21, 2026.
Who is behind these attacks?
Cisco did not say who is behind the VPN attacks. Dream linked one campaign to a suspected attacker tied to China. Kevin Beaumont said he is aware of a ransomware group using PHP2Shell.
Enjoyed this article?
Share it with your network
