[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

hunt idea

Hunt: PAN-OS management CVE-2026-0322 (authenticated RCE) and vendor IoCs

Prioritize firewalls/Panorama whose management interface is reachable from untrusted networks. Correlate admin auth successes with odd CLI/API activity and outbound connections to the vendor-listed probe IPs: 66.42.72.14, 208.83.239.114, 149.248.47.234.
// KQL sketch (firewall / proxy logs ingested to Sentinel)
CommonSecurityLog
| where DeviceVendor has "Palo"
| where DestinationIP in ("66.42.72.14","208.83.239.114","149.248.47.234")
   or SourceIP in ("66.42.72.14","208.83.239.114","149.248.47.234")
| project TimeGenerated, DeviceName, SourceIP, DestinationIP, RequestURL, Message
If Threat Prevention is licensed, confirm content ≥9159-10287 and IDs 510046/510047 are enabled (limited coverage; still patch). Sketch only.

Sources: Palo Alto Networks CVE-2026-0322 (IoCs)