Ransomware Exploits PAN-OS CVE-2026-0257 Authentication Bypass

Critical·KEV·Ransomware·CVSS 9.1·EPSS 97%·4 outletsNew Ransomware Exploits PAN-OS CVE-2026-0257 Authentication Bypass Ransomware groups are actively exploiting an authentication bypass in PAN-OS to establish unauthorized VPN connections. Do this today Review security advisory for CVE-2026-0257 and apply available workarounds or upgrade to a fixed version. Read the full story ↓
Critical·PoC public·CVSS 9.8New FortiSIEM: Unauthenticated RCE via gRPC Path Traversal (CVE-2026-106173) An unauthenticated attacker can achieve RCE on FortiSIEM by exploiting a path traversal flaw in the gRPC service. Do this today Review network traffic for connection attempts to FortiSIEM on port tcp/27918. Read the full story ↓
High·3 outletsNew OVHcloud CLI Compromised: Supply Chain Attack Steals Developer Secrets Attackers compromised OVHcloud's GitHub repository to distribute malware stealing local disk secrets. Do this today Revoke all secrets on any machine that ran a compromised OVHcloud CLI package. Read the full story ↓

From the editor

Defenders must prioritize patching PAN-OS for CVE-2026-0257 due to active ransomware exploitation. Additionally, address the unauthenticated RCE vulnerability in FortiSIEM via gRPC Path Traversal (CVE-2026-106173). Review CI/CD pipelines for potential supply chain compromises affecting developer credentials.

Anmol Singh YadavEditor, PwnSpectrum

Actively Exploited 4

Ransomware Exploits PAN-OS CVE-2026-0257 Authentication Bypass Critical·KEV·Ransomware·CVSS 9.1·EPSS 97%·4 outlets·Unit 42Day 2NewRead Ransomware groups are actively exploiting an authentication bypass in PAN-OS to establish unauthorized VPN connections.
Ransomware operators are exploiting CVE-2026-0257, an authentication bypass flaw in PAN-OS portal and gateway components. This flaw allows unauthorized access to establish VPN connections, bypassing MFA controls. The vulnerability was added to the CISA KEV catalog on May 13, 2026.

Why it matters. Successful exploitation allows initial network access, followed by potential lateral movement to virtualized environments and domain credential dumping.

Do this today Review security advisory for CVE-2026-0257 and apply available workarounds or upgrade to a fixed version.

Affected
PAN-OS

CVE
CVE-2026-0257
1. Tue 20 OctRansomware Exploitation of PAN-OS CVE-2026-0257 via GlobalProtect
2. TodayRansomware Exploits PAN-OS CVE-2026-0257 Authentication Bypass
Read on Unit 42 Post on X LinkedIn

Also covered by The Register, The Hacker News
```
{"coverage":0.898,"evidence":1,"freshness":0.48,"importance":1,"novelty":0.6,"quality":0.95,"total":0.888}
```
F5 Releases Patches for Critical NGINX Vulnerabilities (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205) Critical·Exploited·CVSS 8.1·BleepingComputerNewRead F5 issued emergency patches for three critical NGINX vulnerabilities allowing potential code execution.
F5 released out-of-band patches addressing three critical NGINX flaws: CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205. Exploitation can lead to denial-of-service or code execution via heap-based buffer overflow or use-after-free.

Why it matters. Remote attackers without privileges can exploit these flaws to gain code execution on systems with non-default configurations. Mitigation is advised for systems that cannot immediately patch.

Do this today Apply out-of-band security patches released by F5 for NGINX.

Affected
NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager

CVE
CVE-2026-15176, CVE-2026-93479, CVE-2026-97205

Read on BleepingComputer Post on X LinkedIn

Also covered by CSO Online
```
{"coverage":0.613,"evidence":0.9,"freshness":0.376,"importance":0.75,"novelty":1,"quality":0.95,"total":0.775}
```
WordPress RCE via Chained Flaws: CVE-2026-63030 and CVE-2026-60137 Critical·KEV·PoC public·CVSS 9.8·EPSS 11%·Seqrite Researchers via GBHackersNewRead Chaining two core WordPress flaws allows unauthenticated remote code execution on default installations.
An attack chain combines CVE-2026-63030, which confuses the REST API batch controller, with CVE-2026-60137, an SQL injection vulnerability in the posts endpoint. This allows unauthenticated attackers to achieve remote code execution.

Why it matters. Exploitation affects default WordPress installations without requiring vulnerable extensions or stolen passwords. The attack can lead to administrative context assumption and privileged account provisioning.

Do this today Patch to WordPress 6.9.5, 7.0.2, or higher; review for unexpected administrator accounts, newly installed plugins, or modified PHP files.

Affected
WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1

CVE
CVE-2026-60137, CVE-2026-63030

Read the original · Seqrite Researchers Post on X LinkedIn

Summarised from GBHackers.
```
{"coverage":0.387,"evidence":1,"freshness":0.67,"importance":0.75,"novelty":1,"quality":0.65,"total":0.765}
```
Zimbra Collaboration Suite: Command Injection Vulnerability (CVE-2026-73570) Critical·KEV·CVSS 8.9·EPSS 72%·Microsoft via GBHackersNewRead Command injection in Zimbra's SNMP processing allows unauthenticated remote code execution on email servers.
An attacker can exploit a command injection vulnerability (CVE-2026-73570) in the Zimbra Collaboration Suite via crafted email input to the SNMP notification processing. This allows command execution as the Zimbra service account without user interaction. Attackers observed deploying webshells and escalating privileges using this vector.

Why it matters. Compromise of internet-facing email servers can lead to credential theft, data staging, and potential exfiltration of sensitive mailbox data. Attackers can establish persistence via systemd unit creation and gain passwordless sudo access.

Do this today Upgrade to Zimbra version 10.1.20 or later; if patching is not possible, remove the zimbra-snmp package and disable SNMP notifications.

Affected
Zimbra Collaboration Suite

CVE
CVE-2026-73570

Read the original · Microsoft Post on X LinkedIn

Summarised from GBHackers.
```
{"coverage":0.387,"evidence":1,"freshness":0.639,"importance":0.75,"novelty":1,"quality":0.65,"total":0.762}
```

Its public repositories show a scripted history rewrite on 5 March 2026 and a hidden preinstall.js loader that decodes to a second stage using a Solana memo dead drop

OpenSourceMalware researchers, via BleepingComputer

Vulnerabilities & Patches 4

FortiSIEM: Unauthenticated RCE via gRPC Path Traversal (CVE-2026-106173) Critical·PoC public·CVSS 9.8·Horizon3.aiNewRead An unauthenticated attacker can achieve RCE on FortiSIEM by exploiting a path traversal flaw in the gRPC service.
CVE-2026-106173 allows an unauthenticated attacker to exploit a path traversal vulnerability in the FortiSIEM gRPC service. This flaw permits arbitrary file writes by abusing null-byte handling in the path construction. Successful exploitation can lead to overwriting existing files, such as scripts executed by cron jobs, resulting in remote code execution.

Why it matters. The vulnerability allows unauthenticated remote code execution by manipulating file paths written to the filesystem via the gRPC service on port tcp/27918.

Do this today Review network traffic for connection attempts to FortiSIEM on port tcp/27918.

Affected
FortiSIEM

CVE
CVE-2026-106173

Read on Horizon3.ai Post on X LinkedIn

Also covered by The Hacker News, r/netsec
```
{"coverage":0.613,"evidence":0.7,"freshness":0.708,"importance":0.75,"novelty":1,"quality":0.85,"total":0.748}
```
Oracle E-Business Suite: TCF SQLi Leading to RCE (CVE-2026-101767) High·CVSS 9.8·Horizon3.aiNewRead Unauthenticated SQL injection in Oracle E-Business Suite allows remote code execution via the TCF servlet.
CVE-2026-101767 is a critical, unauthenticated SQL injection vulnerability in Oracle E-Business Suite. Exploitation via the TCF servlet allows an attacker to execute SQL as the APPS database user and subsequently run operating system commands as the EBS application account.

Why it matters. Successful exploitation grants access to read or modify sensitive application data and execute commands on the application host. Internet-facing web tiers are at direct risk.

Do this today Apply the Oracle October 2026 Critical Patch Update patches.

Affected
Oracle E-Business Suite 12.2.3 through 12.2.15

CVE
CVE-2026-101767

Read on Horizon3.ai Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.7,"freshness":0.904,"importance":0.75,"novelty":1,"quality":0.85,"total":0.733}
```
KVM PwnEscape Vulnerability Allows Guest-to-Host Escape High·CVSS 9.3·5 outlets·PWN.AI via Risky BulletinDay 4NewRead A PwnEscape vulnerability in KVM allows a guest VM to potentially read and write host memory.
A vulnerability, tracked as CVE-2026-74580 and CVE-2026-99999, exists in the Linux networking stack used by KVM. This flaw permits a malicious guest to modify IP packets after kernel validation, enabling host memory access.

Why it matters. Exploitation allows a guest virtual machine to potentially read and write the underlying host's memory, leading to code execution on the host system.

Do this today Apply the Linux kernel patch addressing the KVM guest-host escape vulnerability.

Affected
KVM on x86 CPU architectures

CVE
CVE-2026-74580, CVE-2026-99999
1. Thu 15 OctLinux Kernel vhost Flaw (CVE-2026-74580) Allows Local Root and Host Escape
2. Sat 17 OctLinux Kernel Flaws Allow Local Root and VM Host Escape
3. Tue 20 OctKVM PwnEscape Vulnerability Allows Hypervisor Escape
4. TodayKVM PwnEscape Vulnerability Allows Guest-to-Host Escape
Read the original · PWN.AI Post on X LinkedIn

Summarised from Risky Bulletin; also covered by The Register, The Hacker News.
```
{"coverage":1,"evidence":0.7,"freshness":0.01,"importance":0.75,"novelty":0.6,"quality":0.9,"total":0.701}
```
Moxa AIG-302 ThingsPro Edge: Information Disclosure via Internal API High·CVSS 8.6·CISANewRead Firmware versions of the Moxa AIG-302 ThingsPro Edge are vulnerable to information disclosure.
A missing authorization vulnerability exists in the internal API /api/v1/secrets/ for the Moxa AIG-302 ThingsPro Edge. Successful exploitation could allow an attacker to obtain and disclose sensitive information.

Why it matters. Exploitation could lead to the disclosure of confidential data, including cryptographic key material. This impacts critical infrastructure sectors such as energy and water systems.

Do this today Update Moxa AIG-302 ThingsPro Edge firmware to a patched version.

Affected
Moxa AIG-302 ThingsPro Edge firmware <=1.4.0

CVE
CVE-2026-109812, CVE-2026-109813

Read on CISA Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.4,"freshness":0.697,"importance":0.75,"novelty":1,"quality":0.95,"total":0.648}
```

Worth watching

Exploitation the fridge situation is insane Low Level · 19 Oct
Walkthrough HackTheBox - Eloquia IppSec · 17 Oct
Malware analysis I Built A Device That Steals Cars Marcus Hutchins · 16 Oct
Tool demo Building Continuous Attack Surface Management w/ Scout Kinsey Black Hills Information Security · 19 Oct

Malware & Ransomware 1

OVHcloud CLI Compromised: Supply Chain Attack Steals Developer Secrets High·3 outlets·OpenSourceMalware via BleepingComputerNewRead Attackers compromised OVHcloud's GitHub repository to distribute malware stealing local disk secrets.
Attackers hijacked a developer's GitHub account to modify five releases of the OVHcloud CLI tool. The malicious binary was designed to steal secrets stored on the local disk of any machine running it.

Why it matters. Execution of the compromised CLI package risks the theft of sensitive credentials and secrets from the affected system.

Do this today Revoke all secrets on any machine that ran a compromised OVHcloud CLI package.

Affected
OVHcloud CLI versions v0.11.0 through v0.15.0

Read the original · OpenSourceMalware Post on X LinkedIn

Summarised from BleepingComputer; also covered by The Hacker News, GBHackers.
```
{"coverage":0.774,"evidence":0,"freshness":0.63,"importance":0.75,"novelty":1,"quality":0.95,"total":0.599}
```

Threat Actors & Campaigns 2

SafePay Ransomware Group Targets Critical Infrastructure; FBI Advises Caution High·CISA via The RecordNewRead SafePay is highly active, targeting critical infrastructure using password guessing, vulnerability exploitation, and phishing.
International law enforcement reports SafePay has breached over 600 organizations since August 2024. The group targets businesses and critical infrastructure using password guessing, vulnerability exploitation, and phishing.

Why it matters. Attackers establish control by creating or taking over accounts and use legitimate tools to move laterally and disable security protections.

Do this today Review and secure internet-exposed systems against vulnerabilities including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.

Read the original · CISA Post on X LinkedIn

Summarised from The Record.
```
{"coverage":0.387,"evidence":0,"freshness":0.881,"importance":0.75,"novelty":1,"quality":0.95,"total":0.566}
```
Threat Actors Abuse AI Platform Cairn for Persistent Access and Theft High·NorForge via SecurityWeekNewRead Threat actors are using the open-source AI platform Cairn to automate attacks targeting e-commerce and payment infrastructure.
Threat actors are reportedly abusing the open-source AI platform Cairn to automate malicious operations. Activity clusters indicate goals of persistent access via webshells and financial theft targeting e-commerce and payment services. The actors were successful in approximately 10% of their attempts.

Why it matters. The use of autonomous AI agents for reconnaissance and exploitation increases the speed and scale of potential breaches. Exposed data included hundreds of secrets, some verified as valid credentials.

Read the original · NorForge Post on X LinkedIn

Summarised from SecurityWeek.
```
{"coverage":0.387,"evidence":0,"freshness":0.712,"importance":0.75,"novelty":1,"quality":0.9,"total":0.544}
```

Breaches & Incidents 3

Zeabur: Platform Compromised via Leaked Credentials; Services Shutting Down High·Zeabur via BleepingComputerNewRead Zeabur suffered a second breach using leaked credentials, compromising user data and leading to the platform's shutdown.
Attackers used leaked internal credentials to compromise Zeabur's infrastructure, accessing the production database. This incident affected shared clusters across nine regions and 321,810 accounts. Zeabur has announced it will cease services by December 31, 2026.

Why it matters. The incident demonstrates risks associated with unrotated, long-lived administrator tokens and poor credential management practices.

Do this today Rotate all exposed credentials and secrets immediately; revoke all active sessions.

Affected
Zeabur

Read the original · Zeabur Post on X LinkedIn

Summarised from BleepingComputer.
```
{"coverage":0.387,"evidence":0,"freshness":0.859,"importance":0.75,"novelty":1,"quality":0.95,"total":0.564}
```
Ahold Delhaize: Cyberattack Disrupted US and European Services High·4 outlets·Ahold Delhaize via The RecordDay 2NewRead Ahold Delhaize confirmed a cyberattack last week forced system outages across its US and European operations.
Ahold Delhaize confirmed a cyberattack forced the company to take systems offline across most of its US and European brands. The incident disrupted online services in the US, Netherlands, and Belgium.

Why it matters. The incident confirms the threat of operational disruption for large multinational retailers. Investigations into the nature of the attack remain ongoing.

Affected
Ahold Delhaize US and European brands
1. Tue 20 OctAhold Delhaize Confirms Cyberattack Causing System Outages
2. TodayAhold Delhaize: Cyberattack Disrupted US and European Services
Read the original · Ahold Delhaize Post on X LinkedIn

Summarised from The Record; also covered by BleepingComputer, SecurityWeek.
```
{"coverage":0.898,"evidence":0,"freshness":0.408,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.556}
```
ConnectWise Suspends Cloud Backup Service After Unauthorized Access Attempts High·4 outlets·Huntress via The RecordDay 2NewRead ConnectWise suspended its Cloud Backup service after unauthorized access attempts were detected in its cloud backup environment.
ConnectWise confirmed unauthorized access attempts associated with the ConnectWise Cloud Backup environment. Attackers reportedly used a compromised credential to gain access to customer Microsoft 365 tenants. The service has been suspended while the company remediates and validates security.

Why it matters. The service required broad access to sensitive data, and compromised credentials could allow attackers to gain elevated permissions or establish persistence within customer environments.

Affected
ConnectWise Cloud Backup
1. Tue 20 OctConnectWise Suspends Cloud Backup Service Following Unauthorized Access Attempts
2. TodayConnectWise Suspends Cloud Backup Service After Unauthorized Access Attempts
Read the original · Huntress Post on X LinkedIn

Summarised from The Record; also covered by SecurityWeek, Dark Reading.
```
{"coverage":0.898,"evidence":0,"freshness":0.371,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.552}
```

AI Security 1

AI Agents Breached Over 1,200 Company Websites Info·The Hacker NewsNewRead Autonomous AI agents compromised over 1,200 company websites after operators left control panels exposed.
A hacker utilized autonomous AI agents to breach websites belonging to over 100 companies. The campaign involved more than 1,200 break-in attempts against various corporate sites.

Why it matters. Exposed control panels can allow automated agents to conduct widespread reconnaissance and exploitation with minimal human intervention.

Read on The Hacker News Post on X LinkedIn

Also covered by GBHackers
```
{"coverage":0.613,"evidence":0,"freshness":0.598,"importance":0.75,"novelty":1,"quality":0.8,"total":0.557}
```

CVE spotlight

CVE	Affects	CVSS	EPSS	Status
CVE-2026-73570	Synacor Zimbra Collaboration Suite (ZCS)A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed…	8.9	72%	Exploited (KEV)CISA due 24 Aug (passed)
CVE-2026-63030	WordPress CoreWordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the …	9.8	11%	Exploited (KEV)CISA due 24 Jul (passed)
CVE-2026-60137	WordPress CoreWordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query…	5.9	5%	Exploited (KEV)CISA due 4 Aug (passed)
CVE-2026-0257	Palo Alto Networks PAN-OSAuthentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to …	9.1	97%	Exploited (KEV)CISA due 1 Jun (passed)ransomware
CVE-2026-93479	—A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log for…	8.1	1%	Not in KEV
CVE-2026-15176	—A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite…	8.1	1%	Not in KEV

Quiz

Yesterday's answer

According to the provided security advisory, on what date was the vulnerability added to the CISA KEV catalog?

CVE-2026-0257

The story explicitly states that the vulnerability was added to the CISA KEV catalog on May 13, 2026.

Today's question

According to the report, on what date was the vulnerability added to the CISA KEV catalog?

On the radar tomorrow

CTF starts Fri 00:30 UTCcruXipher 2026 - ATMoS '26, BITS Hyderabad
WatchingHackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
WatchingHackers hijack AOMEI update servers to secretly spread malware

Also worth your time

Exploits

Teltonika_RutOS 00.07.06.21 - command injectionRemote
TigerGraph_Community_Edition 4.2.4 - arbitrary file writeWebApps
WordPress 7.0.2 - Path TravesalWebApps
Food-Ordering 1.0 - LFIWebApps
Ecava_ntegraXor IGX_16.0.701.10 - RCERemote

Tools

horizon3ai/CVE-2026-106173In today's news · via Horizon3.ai · Exploitation · PythonThis code provides a proof of concept to achieve unauthenticated remote code execution on FortiSIEM via gRPC path traver…
V4bel/ZapscapeIn today's news · via Risky Bulletin · Exploitation · CDemonstrates a guest-to-host escape vulnerability in KVM/x86 via a use-after-free in shadow MMU emulation.
semgrep/semgrep v1.182.0New release v1.182.0 · Web & AppSecObjective-C support enables search and taint mode rules on .m files; C# Pro supports Unicode identifiers; HCL supports n…
glaz-boga-poisk-bot/glaz-bogaNew · 229 stars in 29 days · OSINTThis tool aggregates publicly available and leaked records to search for personal identifiers across multiple platforms.
irraz/vulnerator-aiNew · 31 stars in 5 days · AI security · PythonAutomates penetration testing using an OODA loop driven by an LLM agent across multiple containerized tools.
JoasASantos/MalvexNew · 37 stars in 6 days · Forensics & malware analysis · RustOrchestrates multiple analysis tools to triage and analyze various sample types, including binaries, memory dumps, and n…

Community

Podcasts

181: RickyDarknet Diaries · 01:20:15
Risky Business #855 -- ShinyHunters done sowing, enters reaping phaseRisky Business · 1:06:27
SN 1101: ECDSA's Curves Origins - When AI Becomes the AttackerSecurity Now · 2:31:36
SANS Stormcast Tuesday, October 20th, 2026: Plex2Shell RCE Exploited; Broadcom eCos Wi-Fi RCE; OVHcloud CLI Compromised; Exchange Issues After October Updates; AI Agent Containment; VBA in DWG YARASANS Internet Storm Center · 7:09

And finally

DHS Bans DeepSeek Products Across US Federal Civilian Agencies

DHS has ordered federal civilian agencies to cease using and remove DeepSeek products. The directive cites national security concerns regarding data handling and potential malware.

Source: Federalregister · via BleepingComputer

End of No. 240

That's today's brief.

On the radarCTF starts Fri 00:30 UTC: cruXipher 2026 - ATMoS '26, BITS Hyderabad

The next brief lands at 06:30 IST.

Wednesday, 21 October 2026

From the editor

Actively Exploited 4

Vulnerabilities & Patches 4

Worth watching

Malware & Ransomware 1

Threat Actors & Campaigns 2

Breaches & Incidents 3

AI Security 1

CVE spotlight

Quiz

On the radar tomorrow

Also worth your time

Exploits

Tools

Community

Podcasts

And finally

Keyboard shortcuts

Top stories

From the editor

Actively Exploited 4

Vulnerabilities & Patches 4

Worth watching

Malware & Ransomware 1

Threat Actors & Campaigns 2

Breaches & Incidents 3

AI Security 1

CVE spotlight

Quiz

On the radar tomorrow

Also worth your time

Exploits

Tools

Community

Podcasts

And finally