Briefings ·
OTASEC Daily Briefing | 23-10-2026
PHP2Shell dominates today, with Palo Alto still without fixed PAN-OS releases and attacks seen since 17 October. Ransomware exploitation of a GlobalProtect flaw and a long-running intrusion in a Russian healthcare network round out the threat picture.
1PHP2Shell: Palo Alto affected, attacks seen since 17 October
Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that allow code execution on a web server without login, and has not yet shipped fixed PAN-OS releases. Fortinet and Cisco published advisories but have not confirmed a vulnerable product so far. Amazon reported that the first PHP2Shell attacks took place on 17 October.
For asset owners: Check where PAN-OS, Panorama and other web-facing management interfaces are exposed, restrict access to them, and follow the vendor advisories for fixes.
2Ransomware groups exploit Palo Alto GlobalProtect flaw CVE-2026-0257
Several ransomware groups have been exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect that was patched in May, since June. Targets span healthcare, education, government and energy. The flaw stems from firewalls relying on cookies without detailed validation and integrity checking.
For asset owners: Verify that GlobalProtect gateways run a release patched for CVE-2026-0257 and review VPN logs for suspicious sessions going back to June.
3Vasilek backdoor hidden in VMware Tools in two-year intrusion
A Belarus-aligned hacktivist group, tracked as Partisan Zmiy and also known as the Cyber Partisans, spent nearly two years inside the network of a Russian healthcare organization, according to a report from the Russian firm Solar. The group hid the Vasilek backdoor in VMware Tools. It has been active since at least 2020.
For asset owners: Include virtualization tooling in integrity checks and threat hunting, since persistence in trusted components can go unnoticed for long periods.
4Update: SafePay victims span four continents
Dutch coverage of the FBI warning adds that at least 600 organizations in critical sectors in Europe, North America, South America and Australia have fallen victim to SafePay ransomware.
For asset owners: Use the published SafePay guidance to review backups, remote access and segmentation between IT and OT.
5Other advisories: Kiloview E3 NDI Encoder and METTLER TOLEDO STARe
CISA published ICSA-26-295-01 for the Kiloview E3 NDI Encoder, covering eight CVEs whose exploitation could allow full device compromise. CERT@VDE reported VDE-2026-112: CVE-2026-10109 affects the IBM Db2 12.1.2 component delivered with METTLER TOLEDO STARe v20.00, linked to improper handling of the pre-authentication DRDA handshake.
For asset owners: Check whether these products are in your inventory and apply the vendor mitigations, keeping them off untrusted networks until fixed.
6Resilience: energy and utilities face rising exposure to ransomware and vulnerable OT
Resilience analysed cyber insurance claims in the energy and utilities sector and reports rising cyber exposure from ransomware and vulnerable OT systems. The analysis also found that email compromise accounted for a notable share of claims.
For asset owners: Use the findings to test whether email security and OT exposure reduction feature in your own risk assessment.
7Guidance: remote oil and gas operations and integrated safety and security
Industrial Cyber looks at securing upstream oil and gas operations, where distance and remoteness shape wellheads, gathering systems and offshore platforms. A separate piece, citing an ISASecure post, argues that ISA/IEC standards require industrial asset owners to integrate functional safety and cybersecurity.
For asset owners: Review whether safety and security engineering are coordinated at your remote sites.