Firewall attacks turn edge access into internal credential theft
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Thursday, October 29th, 2026.
Attackers used exposed firewalls as a path toward internal credentials and administrative systems. A reported China-linked operation scanned nineteen thousand internet-facing devices, narrowed that list to 240 potential targets, and exploited 25 during October 23rd-24. Root webshells were reportedly placed on 24 devices, and activity advanced on two systems in a U.S. government-affiliated environment. From one firewall management server, the attackers reached configurations, credentials, and settings for managed firewalls.
That shows how root access at the edge can become control over systems responsible for many other devices. The attackers also decrypted an LDAP service account password, enumerated domain users and groups, attempted password spraying, and tried to create backdoor accounts.
Leaders should treat firewall management planes as high-value identity and configuration assets. Defenders should patch the PHP and Linux issues, inspect exposed devices for persistent access, and rotate credentials reachable from management systems. The immediate priority is to isolate and investigate exposed firewalls before beginning that credential reset.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
