WAF Weekly: FortiBleed 2.0, php2shell roots firewalls, Oct 23-30

FortiBleed produced fresh secrets and the FBI confirmed the campaign is still running. php2shell moved from websites into firewall management interfaces, where the fix depends on vendor firmware. The perimeter appliance is the attack surface.

FortiBleed 2.0: the leak that keeps giving

The FBI warns FortiBleed attacks are ongoing against exposed Fortinet FortiGate firewalls and SSL VPN gateways. Attackers use leaked credentials, infostealer logs, credential stuffing and password spraying, then crack hashes offline with distributed GPU clusters. The chain is now an initial access method for INC, Lynx and Payload ransomware affiliates. Some operations lock out legitimate admins by deleting their accounts.

This is not a fresh 70,000-credential leak. That figure dates to June. What is new: Hudson Rock's FortiBleed 2.0 research, published October 27, found 40,573 cleartext secrets across 1,703 configuration reports and 975 domain labels absent from the earlier dataset. SOCRadar's latest count reaches 86,644 compromised devices.

php2shell chains into firewall root access

China-linked attackers chained the two php2shell flaws CVE-2026-109618 and CVE-2026-109619 with Fragnesia CVE-2026-46300, a Linux kernel escalation, to root firewalls. Dream observed the group use FOFA to find 19,000 exposed firewalls, filter to 240 targets, and drop root webshells on 24 devices on October 23-24.

On two servers in a US government environment a reverse SSH tunnel reached an internal firewall management server, exposing configurations, credentials and settings for every managed firewall. The attacker decrypted the LDAP service account password and ran password spraying and Active Directory enumeration. The severity is not the exploit chain alone. The management plane of a security product holds the keys to everything behind it.

InfraTrust: exploited flaws across the edge

Eclypsium's October InfraTrust Pulse tracked 133 advisories across 18 vendors, covering 2,813 vulnerabilities. 37 were critical, 58 were remotely exploitable without authentication, and 16 were in CISA's KEV catalog as actively exploited. The roster is familiar: NetScaler ADC and Gateway, Check Point Management Server, Palo Alto PAN-OS, F5 BIG-IP APM, Ivanti Connect Secure and FortiMail.

InfraTrust adds the php2shell wrinkle: appliances compile PHP into firmware, so customers cannot install the PHP security updates themselves. They wait for vendors to rebuild firmware. While waiting, keep PHP-backed management interfaces off the internet. Appliances are embedded code you do not control, and the management interface is the part attackers read first.

Oracle EBS draws probes days after the patch

Threat actors started probing CVE-2026-101767, a critical SQL injection in Oracle E-Business Suite, on October 27, days after Oracle''s October CPU patched it. The flaw scores 9.8, needs no authentication, and runs over HTTP. Horizon3 found it, Defused observed the probes. SQL injection over HTTP against an enterprise app is a WAF-sized problem, but the patch window is the operative detail. Cl0p built a campaign on EBS last year.

OWASP: agents lower the skill floor

OWASP's LLM Exploit Generation Guide 2.0 tested human-guided models and autonomous agents against Hack The Box machines released after model training cutoffs. The strongest run was "vibe hacking": an operator with no security background followed a model to a staging site, found valid accounts, and completed an administrator takeover by copying commands. Autonomous agents reached the takeover stage but provider guardrails stopped the final action.

OWASP's signal for defenders: repeated high-frequency tool use against one target without progress. AI does not remove the need for human judgment, but it lowers the skill required for discovery and research. WAF teams should treat agent traffic like any other automated abuse.

WAFplanet take

Three of this week's main stories involve security products being attacked through their own management plane or firmware. FortiBleed runs on credentials and exposed admin interfaces. php2shell lives inside appliance firmware. InfraTrust counts exploited edge devices month by month. A WAF protects the application in front of you. It does not protect the box in front of you from itself. The controls that matter are the unglamorous ones: no management interface on the internet, MFA on everything, credential rotation, and firmware you can actually update.

We also read

• Wordfence says there are still no confirmed WordPress compromises from php2shell, with answers to the common questions. Wordfence
• Qualys on building a stopgap for php2shell with the controls you own. Qualys
• ModSecurity documentation moved to a new home. ModSecurity
• Wordfence launched a Threat Response Team for reporting active WordPress threats. Wordfence
• Sophos on intent-based access control for AI agents. Sophos
• Bright Security's STAR Fuzzer writes its own harnesses and proves every finding. CSO Online
• Link11 on a botnet that held 1.7 billion requests per second while shrinking from 3,000 to under 600 source IPs. Link11