@CatoCTRLโs Guy Waizel and Etay Maor examine what was being requested, what was circulating and what remained unverified.
Read the full research: https://t.co/7ye9eYSAcG
Attackers are searching for a PHP2Shell exploit that actually works.
In an underground forum, participants requested exploits and questioned the code being shared. One assessment: "Didn't test but seems legit."
For defenders, those doubts raise questions about prerequisites, reliability and the evidence behind an exploit claim. Public analysis discussed in the report examined how PHP version, server settings and target knowledge could affect some circulating PoCs.
In his latest @Forbes article, Catoโs Etay Maor examines how AI is changing the speed and scale of ransomware operations, separating documented uses from sellersโ unproven claims.
Cato also automatically blocks confirmed campaign indicators, without requiring customers to add those indicators manually.
Read the Cato CTRL research for the delivery chain, warning signs, and Catoโs protection: https://t.co/4oUop4tNX8
What looks like a tax document could give an attacker remote access to your computer.
Cato CTRL investigated a phishing campaign targeting Israeli organizations with emails impersonating the Israel Tax Authority.
The lesson extends beyond this Israeli campaign: legitimate remote-support software can be misused when employees are tricked into running and installing it.
Catoโs intrusion prevention system blocked a web request to infrastructure used by this campaign.
Learn how Cato DEM gives IT teams a clearer picture of the real AI experience before users start reporting problemsย
Read our latest blog: https://t.co/FpvITbCaEz
Your AI apps may be working, but are they working well?ย
As employees and developers rely more on AI tools, IT teams face a new challenge: understanding the quality of their AI interactions before performance issues start affecting their productivity.
Cato DEM helps IT teams see the difference by measuring AI interaction latency and errors, with the context to investigate where performance issues are occurring.
The same day PHP2Shell fixes arrived, Cato observed attackers checking for systems they could exploit and early proof-of-concept attempts against systems running PHP.
Customers did not need to install a separate protection package. Cato delivered and enforced the signatures through its cloud, helping reduce exposure while application owners upgraded PHP.