Ransomware groups exploit PAN-OS CVE-2026-0257 for VPN access
CVE-2026-0257 is an authentication bypass in PAN-OS GlobalProtect and Prisma Access that lets attackers bypass security controls and initiate VPN sessions.
Vulnerabilities & Patches
vulnerability CVE zero-day patch exploit advisory update KEV
-
-
Attackers exploit four Plex flaws to deploy miner and proxy malware
The Plex2Shell chain enables unauthenticated remote code execution and attackers have used it to drop XMRig miner and myawesomeproxy.
-
F5 releases out-of-band patches for three critical NGINX flaws
The patches fix CVSS v4.0‑scored 9.2 memory bugs in NGINX versions 1.30.0‑1.30.5 and 1.31.2‑1.31.6.
-
Threat actors exploit Plex2Shell within one day of PoC release
Within roughly one day after the PoC release, threat actors began exploiting Plex2Shell in the wild, with attacks observed on October 17, 2026.
-
Bloom Security researchers expose npm Trusted Publishing flaw affecting 1,500+ packages
GitHub fixed the SlugFest vulnerability on Oct. 2, 2026, by expiring unvalidated Trusted Publishing configurations after 48 hours, according to GitHub.
-
UNC5820 exploited two Fortinet flaws to deploy stealthy PeerStitch implant in telecom network
SecurityWeek reports that the attackers used CVE-2024-47575 for initial access and CVE-2025-61624 to obtain root access and install a memory‑resident backdoor that evaded detection.
-
SANS ISC researchers release YARA rule to detect orphaned VBA in DWG files
The rule, named autocad_orphaned_vba_project, detects orphaned VBA projects hidden inside DWG files.
-
TP‑Link releases firmware fixing six flaws in Tapo C200 V5 and C120 V1
Combining the authentication bypass and command‑injection flaws lets attackers on the same network gain admin access and run commands.
-
Security researchers report high‑severity VBS enclave flaw CVE‑2026‑108471
SentinelOne, app.opencve.io, PremierePC Technology Group and TheHackerWire report that the flaw carries a CVSS v3.1 base score of 8.8, rated as high severity.
-
Microsoft discloses SharePoint privilege‑escalation flaw CVE-2026-96044
The flaw carries a CVSS score of 8.8 and is rated Important by Microsoft.
-
China-linked espionage group exploited BeyondTrust zero-day in Remote Support appliances
Armory Castle, tracked by Mandiant and Google Threat Intelligence, used the flaw starting August 29 to deploy backdoors and harvest credentials, with patches now available.
-
Drupal patches two critical RCE flaws affecting all supported versions
Patched releases include Drupal core 10.6.19, 11.3.19, 11.4.10 and Entity List module 3.0.10.