Ransomware groups still exploit patched Palo Alto GlobalProtect flaw
October 22–25 reports add no new confirmed facts about the GlobalProtect campaign beyond the October 21 account.
Unit 42 says Qilin and INC still use patched CVE-2026-0257 for MFA-bypass VPN access and later ransomware.
Palo Alto Networks Unit 42 says ransomware operators continue exploiting CVE-2026-0257, a CVSS 7.8 authentication bypass in PAN-OS GlobalProtect portals and gateways and Prisma Access. With authentication-override cookies and a vulnerable certificate setup enabled, attackers open VPN sessions that bypass MFA, then move via RMM tools, RDP, and SMB. Unit 42 attributes cases to Spikey Scorpius (Qilin) and Tarnished Scorpius (INC). ReliaQuest and other outlets also name Settra; Unit 42 says that link is from public reporting, not its investigations. Work since early June includes a vCenter path to offline credential theft from a domain-controller VMDK and chaining with Veeam CVE-2023-27532. Palo Alto patched the bug on May 13 after first rating it medium; Panorama and Cloud NGFW are unaffected.
- CISA added CVE-2026-0257 to the KEV catalog on May 13, 2026.
- Rapid7 reported successful exploitation from at least May 17, 2026.
- Exposure needs authentication-override cookies and a reused cookie certificate.
- Sectors include healthcare, government, energy, finance, education, and manufacturing.
- ReliaQuest found Cobalt Strike, BloodHound, and SharpHound in related intrusions.
- Only a small share of probed devices opened gateway VPN sessions.
Timeline
dated events in the reporting · oldest first- May 13, 2026Palo Alto patched CVE-2026-0257; CISA added it to KEV. · The Hacker News
- May 17, 2026Rapid7 reported successful exploitation of the VPN flaw. · The Register
- Oct 19, 2026Unit 42 updated its brief on active ransomware use. · Palo Alto Unit 42
What each outlet adds
beyond the shared facts- Palo Alto Unit 42Few probed devices opened VPN sessions; Settra link is external.
- The RegisterInitial medium rating and no disclosed victim count.
- Help Net SecurityReliaQuest tooling and sessions that can survive patching.
- The Hacker NewsArctic Wolf flagged Qilin use, including double extortion, in July 2026.
- Cyber Security NewsTemporary mitigations and indicators, including two source addresses.
Coverage
oldest first · one row per article · UTC- · 5d ago
Palo Alto Unit 42First report
Qilin and Inc exploit PAN-OS GlobalProtect bypass CVE-2026-0257
Unit 42 says operators bypass MFA for VPN access, then move via RDP and SMB toward ransomware.
- · 5d ago
Cyber Security News
Ransomware groups exploit GlobalProtect MFA bypass CVE-2026-0257
Unit 42 says attackers forged authentication-override cookies, then pulled domain credentials from a VMware virtual disk offline.
- · 5d ago
GBHackers
Ransomware groups exploit PAN-OS flaw CVE-2026-0257 to bypass MFA
Unit 42 says the GlobalProtect cookie bug yielded VPN access and later ransomware across several sectors since early June 2026.
- · 5d ago
The Hacker News
Qilin and INC exploit patched PAN-OS flaw to bypass MFA
Unit 42 says CVE-2026-0257 yields unauthorized VPN sessions, followed by RDP, SMB, and ransomware staging.
- · 5d ago
DataBreaches.net
Qilin and INC exploit patched Palo Alto VPN bypass (CVE-2026-0257)
Unit 42 says the groups still use the May 2026 PAN-OS and Prisma Access fix to open unauthorized VPNs.
- · 5d ago
The Register · Security
Ransomware groups exploit Palo Alto PAN-OS bug CVE-2026-0257
Unit 42 says Qilin, Inc and others use the GlobalProtect flaw for unauthorized VPN access, then ransomware, across many industries.
- · 4d ago
Help Net Security
Ransomware groups exploit Palo Alto GlobalProtect flaw CVE-2026-0257
Unit 42 has investigated intrusions since early June; Qilin, Inc, and Settra are among the operators named.
- · 4d ago
Unit 42 warns of two critical PHP RCE flaws scored 9.2
Unit 42 says it has seen proof-of-concept code and telemetry showing over 22.6 million potentially exposed instances.
- · 4d ago
Kaspersky Securelist
PHP patches two critical unauthenticated RCE flaws after exploit leak
A public PoC dubbed PHP2Shell targets PHP 5 through 8; backports exist for 7.4, 8.0, and 8.1, but attacks are not confirmed.
- · 4d ago
Cisco Security Advisories
Critical PHP RCE flaws affect Cisco products, Cisco says
CVE-2026-109618 and CVE-2026-109619, dubbed PHP2shell, are fixed in a PHP Foundation release announced October 21.
- · 3d ago
PHP RCE flaws probed four days before public patches
Amazon’s MadPot saw attempts from October 17; PHP2Shell was later called broadly exploited.
- · 3d ago
Operators hit FortiGate, FortiWeb and GlobalProtect to steal stored passwords
Group-IB and NyxLab tie the edge-device campaign to k0t and report more than 70,000 exposed credentials.
- · 3d ago
October 21 fixes cover PHP2Shell, LiteLLM theft, and VPN attacks
Fixed PHP builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; LiteLLM 1.107.0 stole secrets, so pin 1.106.2 and rotate them.
- · 3d ago
k0t steals credentials from FortiGate, FortiWeb and GlobalProtect
Group-IB reports more than 70,000 exposed credentials and active use of CVE-2025-64446 and CVE-2026-0257.
- · 2d ago
Tenable Blog
Criminal forums go offline after PHP2Shell disclosure
BreachForums, DarkForums, PwnForums and Dread paused or migrated within 48 hours, citing risk to member data.
- · 2d ago
The Record
PHP2Shell exploit attempts rise, but experts doubt they succeed
Amazon and others report scans since October 17, while researchers say public PoCs fail on typical PHP setups.
- · 2d ago
k0t exploits edge firewalls and VPNs, exposing over 70,000 credentials
Group-IB and NyxLab say k0t used FortiWeb and PAN-OS flaws, then remote-access tools and cloud exfiltration, from February to June 2026.
- · 1d ago
Palo Alto says PHP RCE flaws affect PAN-OS; hotfixes still pending
CVE-2026-109618 and CVE-2026-109619 hit several PAN-OS branches via management interfaces; Palo Alto reports no attacks on its products.
- · 2h ago
PHP2Shell exploited at a European government entity, Unit 42 says
Within two hours the attackers reached password hashes, MFA secrets, and an NTLM-relay path toward Domain Admin.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-6693 | Hard-Coded Encryption Key in Fortinet FortiOS Configuration Backups | 6.5 | 7% | KEVRansomware | KEV |
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials | 7.5 | 81% | KEVRansomware | KEV |
| CVE-2025-64446 | Unauthenticated Path Traversal in Fortinet FortiWeb Enables Admin Command Execution | 9.8 | 92% | KEVPoC | KEV |
| CVE-2026-0257 | Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway | 7.8 | 97% | KEVRansomware | KEV |
| CVE-2026-101296 | Auth bypass in Apache Tomcat JNDIRealm with non-GSSAPI SASL | 9.1 | — | ||
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 | |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 33% | PoC ×16 | |
| CVE-2026-115560 | — | — | PoC ×8 | — |