Your Network Edge Is the Target: What This Week's Palo Alto, Cisco and VMware Attacks Mean for UAE Businesses

Three security stories landed within 48 hours this week, and they have one thing in common: each attack started at the edge of the network, on the devices that sit between a company and the internet.

Palo Alto Networks confirmed that attackers are exploiting the PHP2Shell flaws against firewall management pages left open to the internet. Cisco Talos published details of a state-linked group that broke into Cisco Catalyst SD-WAN controllers through a maximum-severity flaw. And CrowdStrike revealed that another group used a VMware ESX hypervisor flaw to cut down the evidence of its intrusions.

None of this targets exotic equipment. Each attack goes after something most UAE businesses own: a firewall, a branch network or a virtualised server room. Below we summarise what happened and what to check this week.

What happened

• Palo Alto Networks firewalls (PHP2Shell). PHP2Shell is a pair of critical flaws in the PHP language itself (CVE-2026-109618 and CVE-2026-109619, rated 9.2), disclosed earlier this month. PAN-OS uses PHP in its web management interface. On 29 October, Palo Alto Networks confirmed active exploitation against management interfaces exposed to the internet. Researchers at Dream reported one campaign that chained PHP2Shell with a Linux kernel flaw known as Fragnesia to take root control of 25 servers and firewalls, then steal Active Directory credentials. Palo Alto says about 0.02% of its installed base had internet-facing management interfaces and was affected, and that patched devices are not.
• Cisco Catalyst SD-WAN (CVE-2026-20127). This authentication bypass, rated the maximum 10.0, lets an attacker log in to SD-WAN controllers as an administrator without a password. Cisco fixed it in February, but on 28 October Cisco Talos described how a group it tracks as UAT-11473 had used it as a zero-day to plant malware called KeyDrift, which copies the keys that encrypt traffic between company sites. A public exploit now exists. Separately, Cisco confirmed attackers are crashing ASA and Firepower firewalls through a new VPN flaw (CVE-2026-76418), for which upgrading is the only full fix (disabling secondary authentication on the affected VPN tunnel groups reduces exposure until then).
• VMware ESX (CVE-2026-41709). CrowdStrike reported that a China-nexus group it calls Warp Panda exploited this logging flaw as a zero-day to reduce what the hypervisor recorded, after first breaking in through internet-facing edge devices. Broadcom patched it in July, and the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its list of actively exploited vulnerabilities on 28 October.

Why the edge keeps getting hit

Firewalls, VPN gateways and SD-WAN controllers have three properties attackers value. They face the internet by design. They hold the keys to everything behind them, from VPN credentials to the encryption keys between sites. And they rarely run the kind of endpoint protection that would spot an intruder on a laptop or server.

The pattern in this week's reports is consistent: get in through an edge device, move to the systems that manage the rest of the network, such as Active Directory, vCenter or the SD-WAN controller, and then reduce the evidence. The ESX case shows why that last step matters. If an attacker can limit what gets logged, an intrusion can run for months unnoticed.

Patching is also slower at the edge. A firewall upgrade needs a maintenance window and carries a risk of downtime, so it often gets postponed. Attackers count on that delay.

What to check this week

1. Find every management interface. Confirm that no firewall, VPN gateway, SD-WAN controller or hypervisor admin page can be reached from the internet. Management should only be possible from a dedicated internal network or trusted IP addresses.
2. Patch the edge first. Apply the current fixed releases for PAN-OS, Cisco Catalyst SD-WAN, Cisco ASA and Firepower, and VMware ESX. If a device is out of support and cannot be patched, plan its replacement now.
3. Check for signs of past compromise. Patching closes the door but does not remove an intruder who is already inside. Compare your logs against the indicators in each vendor's advisory, and check whether your logs go back far enough to tell.
4. Protect your logs. Send firewall, hypervisor and identity logs to a separate system that an attacker on the device cannot reach or switch off.
5. Check your PHP web servers too. PHP2Shell affects any server running vulnerable PHP versions, not just firewalls. Ask your hosting provider or web team to confirm that PHP has been updated.
6. Know who to call. Have your vendor support contracts and an incident response contact ready before you need them.

Closing thoughts

Edge devices are usually bought once and then expected to run for years. This week shows they need the same care as any server: patched on time, managed only from inside the network, and watched.

At COMMPRO Technologies, we supply and support firewalls, SD-WAN and virtualisation platforms from the major vendors across the UAE and GCC. Not sure whether your edge devices are exposed or up to date? Talk to the COMMPRO team and we will help you check.