Tag: palo alto networks
95 articles
Palo Alto Networks Fixes Authenticated RCE Flaw Under Active Exploitation
Palo Alto Networks has patched a critical vulnerability, CVE-2026-0322, that allowed hackers to execute malicious code with root privileges on its firewalls - and it was under active attack. This authenticated remote code execution flaw, scoring 8.6 in severity, could be exploited by anyone with network access to the PAN-OS management interface.
Palo Alto Networks Discloses Exploited PAN-OS Zero-Day Flaw
Palo Alto Networks has patched a high-severity zero-day flaw, CVE-2026-0322, that lets hackers execute code as root on vulnerable firewalls and appliances. The company says only limited exploitation has been observed so far, but urges users to update their PAN-OS management interface ASAP.
AgentCore Harness Exposes Credential Risks
A default-enabled shell in AgentCore Harness can be exploited through prompt injection, allowing attackers to execute commands and extract plaintext credentials from the harness process memory, putting sensitive data at risk. This simple yet consequential chain highlights a critical vulnerability in credential security.
AMOS Stealer Evolves with Frequent Changes
Meet AMOS Stealer, a sneaky information thief that's been targeting macOS systems since April 2024, and has recently been upgraded with frequent changes to evade detection. This malicious tool can quietly harvest sensitive credentials, wallets, and local data from unsuspecting users.
Cloud Identities Exposed Through Behavioral Clustering Analysis
Mapping the complex roles of human, machine, and autonomous agent identities in cloud environments is a daunting security challenge - but a practical, data-driven solution can turn audit logs into a revealing behavioral map. By analyzing API activity across 125 cloud environments, researchers have developed a clever method for grouping identities into functional roles, shining a light on what they actually do.
AI Agents Automate Ransomware Attack, Leaving 80-Page Security Audit
In a chilling display of efficiency, AI-powered agents automated a ransomware attack on an enterprise network in under 10 hours - a process that would typically take human operators two weeks to complete. This lightning-fast breach was made possible by frontier AI models and agentic frameworks that executed each step of the intrusion with alarming precision.
Microsoft Teams Targeted in Voice Phishing Campaigns
Beware of voice phishing scams on Microsoft Teams! A recent campaign, dubbed Spring Ring, used fake IT help desk accounts to trick over 150 employees across 10 organizations into granting remote access.
AI Reshapes Cyber Threat Landscape, Favoring Attackers
The balance of power in cybersecurity has been dramatically upset, with AI capabilities now favoring attackers and rendering traditional defenses obsolete in the face of machine-speed attacks. This marks a generational shift, where attackers have the upper hand and organizations must adapt to keep up.
Kimwolf Botnet Evolves to Evade DDoS Detection
The Kimwolf botnet has levelled up its game with a new upgrade, v7, which uses HTTP/2 floods to mimic real browser traffic, making it super tricky to detect as a DDoS attack. This sneaky move lets the botnet build complete browser fingerprints, blurring the line between legit and malicious traffic.
China Probes Palo Alto Networks Product Security
China is investigating the security of Palo Alto Networks' products, sparking a mysterious probe that's left many questions unanswered. The inquiry, reported by The Register, puts the spotlight on Palo Alto Networks and its offerings.
XCSSET Malware Targets macOS Devs Through Compromised Xcode Projects
macOS developers, beware: XCSSET malware is lurking in compromised Xcode projects, infecting unsuspecting victims through a sneaky four-stage infection chain that can deploy 17 distinct modules. This latest variant has been rewritten to dig deep into your workflow and browser, putting your entire development ecosystem at risk.
Malware Exploits Direct IP Connections to Evade DNS-Based Defenses
Nearly half of malware samples with command-and-control activity connect directly to IP addresses, dodging DNS-based defenses and highlighting a significant blind spot in traditional security measures. This alarming trend was uncovered in an analysis of over 4 million dynamic reports, revealing that 45.32% of malicious code uses direct-to-IP connections to evade detection.
AI-Powered Vulnerability Discovery Surges, Threatens Patch Window
In a staggering two-month sprint, Palo Alto Networks' NOVA uncovered 14,090 confirmed vulnerabilities in just 3,915 open-source software projects - a remarkable demonstration of AI-powered vulnerability discovery's rapid impact. This autonomous pipeline is revolutionizing the way we identify and tackle software vulnerabilities.
Malware Exploits Google Passkey Sync Flaws
Google's passkeys, touted as a secure alternative to passwords, have been found to have flaws that can be exploited by malware, allowing hackers to access sensitive information. Researchers have discovered three techniques, dubbed Pass-ta-key, that let attackers abuse Google Password Manager's synced passkeys on compromised Windows devices.
AI-Powered Attacks Target Vulnerable Servers With Autonomous Exploits
Meet the AI-powered attackers who just took autonomous exploitation to the next level - and here's how researchers uncovered their clever tactics. A China-based threat actor's accidental leak exposed a functional, end-to-end AI-driven attack workflow.
Chinese Hackers Leverage DeepSeek for Autonomous Exploits
Meet the sneaky Chinese hackers who've been using an AI-powered tool called DeepSeek to launch autonomous cyber attacks on over 460 targets - and get a glimpse into their clever tactics. With just a single Telegram instruction, DeepSeek can infiltrate and exploit systems all on its own.
Qilin Ransomware Exploits Palo Alto Networks Flaw for Initial Access
In a recent wave of attacks, hackers exploited a high-severity flaw in Palo Alto Networks' PAN-OS software to gain initial access for Qilin ransomware attacks. This vulnerability, known as CVE-2026-0257, allowed attackers to bypass authentication and establish VPN sessions without valid credentials.
Qilin Ransomware Gang Exploits Palo Alto VPN Bug in Ongoing Attacks
The Qilin ransomware gang is actively exploiting a critical vulnerability in Palo Alto Networks' VPN software, CVE-2026-0257, to breach security and launch attacks, despite a patch being released on May 13. This alarming development follows reports of multiple intrusions by Qilin in June, highlighting the urgent need for updates.
Private 5G Networks Expose Government to Hidden Security Risks
Government agencies and military organizations risk exposing themselves to hidden security threats if they don't adopt a zero-trust approach to their private 5G networks, leaving them vulnerable to potentially devastating attacks. Without proper security measures in place, adversaries could gain unrestricted access to sensitive information and wreak havoc.
Startup Sues Palo Alto Networks Unit Over AI-Generated Espionage Claims
When a cybersecurity report wrongly labeled MeetingTV a part of a Chinese espionage operation, its CEO knew it was a death sentence - and now the video conferencing startup is fighting back with a lawsuit against Palo Alto Networks and Koi Security. MeetingTV alleges the report, generated by AI, was reckless and falsely accused it of criminal conduct.
AI Models Expose Millions to Phantom Squatting Phishing Threat
Millions are now at risk of falling prey to a new, rapidly evolving phishing threat called phantom squatting, where attackers exploit AI-generated links to create malicious websites that can evade detection. By registering domains invented by large language models, hackers can create seemingly trustworthy sites that are actually designed to steal sensitive information or spread malware.
Chinese Hackers Target Southeast Asia's Energy, Government Sectors
Chinese hackers have launched a stealthy assault on Southeast Asia's energy and government sectors, infiltrating at least ten organizations between October and December 2025. This sophisticated threat, tracked as CL-STA-1062, has been lurking in the shadows since March 2022, using clever tactics like hard-coded encryption keys to evade detection.
MacOS ClickFix Attack Exploits Terminal Commands to Spread Infostealer
Beware of a sneaky new attack on macOS, known as ClickFix, that tricks you into pasting a Terminal command, allowing hackers to silently download and launch info-stealing malware on your device. This cleverly crafted scam starts with a fake CAPTCHA page, convincing victims to unwittingly give attackers a backdoor to their sensitive data.
Cloud Providers' Global Namespace Flaw Enables Bucket Hijacking
A newly discovered flaw in cloud providers' global namespace has been exploited in a simple yet powerful bucket hijacking technique, allowing attackers to redirect sensitive data streams into their own accounts. This alarming vulnerability affects multiple services across major cloud providers.