RE: https://cyberplace.social/@GossiTheDog/117515798886610105 I’m aware of a ransomware group using PHP2Shell against Palo-Alto firewalls to gain initial access to orgs. They’re moving laterally off the PANOS box using stored creds to get inside network.