Ransomware operation Settra has joined Qilin in exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ GlobalProtect VPN, according to a ReliaQuest warning posted October 9, 2026. Palo Alto disclosed the flaw on May 13, 2026, with fixes following that month, and CISA added it to its Known Exploited Vulnerabilities catalog on May 29. Five months on, attackers are still finding unpatched gateways.
Rated 7.8 (High) under CVSS v4.0 by the vendor and 9.1 (Critical) by NVD, the bug lets an attacker with no valid credentials open a VPN session — but only on portals or gateways with authentication override cookies enabled and a particular certificate setup. Panorama and Cloud NGFW are not affected.
ReliaQuest says the resulting traffic can pass for ordinary remote work until credential theft, lateral movement, or ransomware is already underway, and has seen Cobalt Strike, BloodHound, and SharpHound follow the initial access. Affected builds sit in PAN-OS 12.1, 11.2, 11.1, and 10.2, plus Prisma Access 11.2 and 10.2. Fixed releases are 12.1.7, 11.2.12, 11.1.15, and 10.2.18-h6 (or the hotfix for your branch), and Prisma Access 11.2.7-h13 and 10.2.10-h36.
Upgrade every portal and gateway together or cookies stop working between them, and expect users to sign in again once. Can’t patch yet? Either disable authentication override cookies or move them to a freshly generated certificate used for nothing else. Then terminate all active GlobalProtect sessions and investigate any you don’t recognize — patching alone won’t evict anyone already inside.
Source: Cybersecurity News
Ransomware operation Settra has joined Qilin in exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ GlobalProtect VPN, according to a ReliaQuest warning posted October 9, 2026. Palo Alto disclosed the flaw on May 13, 2026, with fixes following that month, and CISA added it to its Known Exploited Vulnerabilities catalog on May 29. Five months on, attackers are still finding unpatched gateways.
Rated 7.8 (High) under CVSS v4.0 by the vendor and 9.1 (Critical) by NVD, the bug lets an attacker with no valid credentials open a VPN session — but only on portals or gateways with authentication override cookies enabled and a particular certificate setup. Panorama and Cloud NGFW are not affected.
ReliaQuest says the resulting traffic can pass for ordinary remote work until credential theft, lateral movement, or ransomware is already underway, and has seen Cobalt Strike, BloodHound, and SharpHound follow the initial access. Affected builds sit in PAN-OS 12.1, 11.2, 11.1, and 10.2, plus Prisma Access 11.2 and 10.2. Fixed releases are 12.1.7, 11.2.12, 11.1.15, and 10.2.18-h6 (or the hotfix for your branch), and Prisma Access 11.2.7-h13 and 10.2.10-h36.
Upgrade every portal and gateway together or cookies stop working between them, and expect users to sign in again once. Can’t patch yet? Either disable authentication override cookies or move them to a freshly generated certificate used for nothing else. Then terminate all active GlobalProtect sessions and investigate any you don’t recognize — patching alone won’t evict anyone already inside.
Source: Cybersecurity News
A high-severity vulnerability (CVE-2026-23870, CVSS 7.5) in React Server Components lets attackers freeze Next.js servers with a single crafted POST request — no authentication needed.
The flaw lives in how React rebuilds form data before running a Server Action. A request with 10 000 references and 10 000 form fields triggers roughly 100 million string comparisons, choking the CPU and blocking Node.js’s event loop. Researcher Simon Koeck showed that a request of around 900 KB is enough to trigger that workload, and the article notes legitimate users can end up with slow loads, timeouts, or 503s.
Because the parsing happens before your Server Action’s own code runs, checks written inside the action won’t help. Public endpoints are the most exposed, but any logged-in user who can reach a Server Action is enough.
React patched versions 19.0.0–19.0.5, 19.1.0–19.1.6, and 19.2.0–19.2.5 in releases 19.0.6, 19.1.7, and 19.2.6. Check your resolved dependency tree rather than your top-level Next.js version — the affected packages are react-server-dom-webpack, react-server-dom-turbopack, and react-server-dom-parcel, and they arrive through framework dependencies. Proxy body-size limits and rate controls cut exposure, but patching React is the actual fix.
Source: Cybersecurity News
A high-severity vulnerability (CVE-2026-23870, CVSS 7.5) in React Server Components lets attackers freeze Next.js servers with a single crafted POST request — no authentication needed.
The flaw lives in how React rebuilds form data before running a Server Action. A request with 10 000 references and 10 000 form fields triggers roughly 100 million string comparisons, choking the CPU and blocking Node.js’s event loop. Researcher Simon Koeck showed that a request of around 900 KB is enough to trigger that workload, and the article notes legitimate users can end up with slow loads, timeouts, or 503s.
Because the parsing happens before your Server Action’s own code runs, checks written inside the action won’t help. Public endpoints are the most exposed, but any logged-in user who can reach a Server Action is enough.
React patched versions 19.0.0–19.0.5, 19.1.0–19.1.6, and 19.2.0–19.2.5 in releases 19.0.6, 19.1.7, and 19.2.6. Check your resolved dependency tree rather than your top-level Next.js version — the affected packages are react-server-dom-webpack, react-server-dom-turbopack, and react-server-dom-parcel, and they arrive through framework dependencies. Proxy body-size limits and rate controls cut exposure, but patching React is the actual fix.
Source: Cybersecurity News
A Kansas City man is heading to federal prison after sabotaging the company he worked for and demanding 20 bitcoin, worth roughly $750,000 at the time. Daniel Rhyne, 59, was a core infrastructure engineer at a New Jersey industrial firm when he secretly scheduled tasks on the company’s domain controller in November 2023.
The tasks deleted 13 domain administrator accounts, reset 301 domain user passwords, and changed local administrator passwords affecting 254 servers and 3 284 workstations — mostly to “TheFr0zenCrew!”. Within an hour, employees received an email from an outside address claiming admins were locked out and backups destroyed, and threatening to shut down 40 random servers a day for ten days unless the company paid.
The company didn’t pay. It ran its own forensic analysis, matched internal logs against physical access records, and brought in the FBI, which traced the activity to Rhyne’s home IP address. Agents filed a criminal complaint in August 2024 and arrested him later that month in Kansas City, where he had since moved.
Rhyne pleaded guilty in April to extortion and intentional damage to a protected computer. He was sentenced on September 28, 2026 to 32 months in federal prison.
Source: SecurityWeek
A Kansas City man is heading to federal prison after sabotaging the company he worked for and demanding 20 bitcoin, worth roughly $750,000 at the time. Daniel Rhyne, 59, was a core infrastructure engineer at a New Jersey industrial firm when he secretly scheduled tasks on the company’s domain controller in November 2023.
The tasks deleted 13 domain administrator accounts, reset 301 domain user passwords, and changed local administrator passwords affecting 254 servers and 3 284 workstations — mostly to “TheFr0zenCrew!”. Within an hour, employees received an email from an outside address claiming admins were locked out and backups destroyed, and threatening to shut down 40 random servers a day for ten days unless the company paid.
The company didn’t pay. It ran its own forensic analysis, matched internal logs against physical access records, and brought in the FBI, which traced the activity to Rhyne’s home IP address. Agents filed a criminal complaint in August 2024 and arrested him later that month in Kansas City, where he had since moved.
Rhyne pleaded guilty in April to extortion and intentional damage to a protected computer. He was sentenced on September 28, 2026 to 32 months in federal prison.
Source: SecurityWeek
The FBI has arrested another suspect in the ShinyHunters hack of its own job recruitment website. Director Kash Patel confirmed the arrest Friday, calling it part of an ongoing push to “dismantle the group.” The bureau gave no name or location, but sources told CBS News the suspect is a Canadian citizen detained in Pennsylvania and believed to be directly involved.
Veteran agents say the September breach may be the worst of a federal government system since the 2015 Office of Personnel Management hack, which exposed more than 22 million records. ShinyHunters claimed responsibility, saying they stole 2–3 terabytes of FBI employee data through a new vulnerability in Oracle PeopleSoft.
The FBI’s cyber division says a review found that a contractor failed to apply a security patch to the targeted system, and that the contractor has since been removed. Reuters, citing sources, reported the individual worked for Accenture.
The Royal Canadian Mounted Police says it is aware of a Canadian arrested in the US over the hack but won’t comment on another country’s investigation. Other suspected co-conspirators remain at large. Two earlier arrests are tied to the group, in Jordan and Amsterdam — though the Amsterdam suspect went into custody on September 15, a week before ShinyHunters announced the FBI hack.
Source: CBS News
The FBI has arrested another suspect in the ShinyHunters hack of its own job recruitment website. Director Kash Patel confirmed the arrest Friday, calling it part of an ongoing push to “dismantle the group.” The bureau gave no name or location, but sources told CBS News the suspect is a Canadian citizen detained in Pennsylvania and believed to be directly involved.
Veteran agents say the September breach may be the worst of a federal government system since the 2015 Office of Personnel Management hack, which exposed more than 22 million records. ShinyHunters claimed responsibility, saying they stole 2–3 terabytes of FBI employee data through a new vulnerability in Oracle PeopleSoft.
The FBI’s cyber division says a review found that a contractor failed to apply a security patch to the targeted system, and that the contractor has since been removed. Reuters, citing sources, reported the individual worked for Accenture.
The Royal Canadian Mounted Police says it is aware of a Canadian arrested in the US over the hack but won’t comment on another country’s investigation. Other suspected co-conspirators remain at large. Two earlier arrests are tied to the group, in Jordan and Amsterdam — though the Amsterdam suspect went into custody on September 15, a week before ShinyHunters announced the FBI hack.
Source: CBS News
Google confirmed that several of its domains were caught up in a recent hijacking of three country-code top-level domains — .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). Attackers compromised the third-party registries behind them in late September, modified authoritative DNS records, and obtained unauthorized HTTPS certificates for Google and other organizations’ domains. Every domain ending in those suffixes was at risk, though Google says its own systems were never breached.
Google quickly blocked the rogue certificates for its own domains in Chrome and worked with certificate authorities to revoke them. Certificate Transparency (CT) log analysis turned up other global brands and popular services in the same position, and the company blocked those certificates too. The CAs aren’t at fault, Google says, given how the attacks worked. How attackers reached the registries, who ran the campaign, and when it started are all still unanswered.
Some domains may still be at risk. Domain owners should monitor CT logs across their whole portfolio, including parked and regional ccTLD names, and review recent entries for certificates they never requested. Restrictive CAA DNS records are worth publishing once DNS control is back. CAA can’t stop issuance during a live hijack, but CAs may reuse a cached domain validation check to mint fresh certificates after one ends, and a restrictive policy closes that door.
Source: SecurityWeek
Google confirmed that several of its domains were caught up in a recent hijacking of three country-code top-level domains — .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). Attackers compromised the third-party registries behind them in late September, modified authoritative DNS records, and obtained unauthorized HTTPS certificates for Google and other organizations’ domains. Every domain ending in those suffixes was at risk, though Google says its own systems were never breached.
Google quickly blocked the rogue certificates for its own domains in Chrome and worked with certificate authorities to revoke them. Certificate Transparency (CT) log analysis turned up other global brands and popular services in the same position, and the company blocked those certificates too. The CAs aren’t at fault, Google says, given how the attacks worked. How attackers reached the registries, who ran the campaign, and when it started are all still unanswered.
Some domains may still be at risk. Domain owners should monitor CT logs across their whole portfolio, including parked and regional ccTLD names, and review recent entries for certificates they never requested. Restrictive CAA DNS records are worth publishing once DNS control is back. CAA can’t stop issuance during a live hijack, but CAs may reuse a cached domain validation check to mint fresh certificates after one ends, and a restrictive policy closes that door.
Source: SecurityWeek
A now-patched vulnerability in AWS Bedrock AgentCore could have allowed attackers to take over every agent in an AWS account and region with a single chatbot prompt. Tamir Ishay Sharbat of Zenity Labs, an AI security vendor, revealed the flaw — dubbed “AgentCorruption” — at SecTor 2026 in Toronto.
The issue stemmed from agents running inside Firecracker MicroVMs without proper network isolation, letting attackers query AWS’s Instance Metadata Service (IMDS) for temporary credentials. From there, broad default permissions meant attackers could invoke other agents, read sessions, and raid AWS Secrets Manager.
AWS patched the flaw in February, enforcing IMDSv2 on all new agents and stripping permissions from default roles — but disputes Zenity’s framing, telling Dark Reading the research recasts documented, intended behavior as a vulnerability. Zenity is now investigating whether similar weaknesses exist on other cloud platforms, and Sharbat says the IMDS problem isn’t specific to AWS. Keep each agent’s role narrow, he says, and anyone who reaches IMDS finds a smaller blast radius.
Source: Dark Reading
A now-patched vulnerability in AWS Bedrock AgentCore could have allowed attackers to take over every agent in an AWS account and region with a single chatbot prompt. Tamir Ishay Sharbat of Zenity Labs, an AI security vendor, revealed the flaw — dubbed “AgentCorruption” — at SecTor 2026 in Toronto.
The issue stemmed from agents running inside Firecracker MicroVMs without proper network isolation, letting attackers query AWS’s Instance Metadata Service (IMDS) for temporary credentials. From there, broad default permissions meant attackers could invoke other agents, read sessions, and raid AWS Secrets Manager.
AWS patched the flaw in February, enforcing IMDSv2 on all new agents and stripping permissions from default roles — but disputes Zenity’s framing, telling Dark Reading the research recasts documented, intended behavior as a vulnerability. Zenity is now investigating whether similar weaknesses exist on other cloud platforms, and Sharbat says the IMDS problem isn’t specific to AWS. Keep each agent’s role narrow, he says, and anyone who reaches IMDS finds a smaller blast radius.
Source: Dark Reading
ASOS has admitted that hackers stole far more customer data than it initially disclosed — and only after BBC News told the retailer the criminals had sent it a sample of the stolen data. Names, addresses, phone numbers, emails, customer numbers, dates of birth, and even search histories are now in criminal hands. When the hack surfaced on October 6, 2026, ASOS had said only basic contact details may have been accessed.
ASOS says the breach began when hackers impersonated a trusted contact to obtain an employee’s login credentials. The group, calling themselves Xuanyewen (also reported as Xuanye Group), told the BBC they reached the data through Simon AI, a platform built on Snowflake — a claim ASOS has not confirmed, and Snowflake says its own platform was not breached.
No passwords or bank details were taken, and ASOS says customers don’t need to take any action. But experts warn them to watch for convincing phishing attempts and impersonation scams using their stolen personal details.
Source: BBC News
ASOS has admitted that hackers stole far more customer data than it initially disclosed — and only after BBC News told the retailer the criminals had sent it a sample of the stolen data. Names, addresses, phone numbers, emails, customer numbers, dates of birth, and even search histories are now in criminal hands. When the hack surfaced on October 6, 2026, ASOS had said only basic contact details may have been accessed.
ASOS says the breach began when hackers impersonated a trusted contact to obtain an employee’s login credentials. The group, calling themselves Xuanyewen (also reported as Xuanye Group), told the BBC they reached the data through Simon AI, a platform built on Snowflake — a claim ASOS has not confirmed, and Snowflake says its own platform was not breached.
No passwords or bank details were taken, and ASOS says customers don’t need to take any action. But experts warn them to watch for convincing phishing attempts and impersonation scams using their stolen personal details.
Source: BBC News
A cyberattack on Arizona's court system compromised personal information for 1.3 million people, believed to have started when a court employee clicked a malicious link in an email. Those 1.3 million were referred to the court's FARE debt collection program over unpaid fees, fines, and restitution for traffic and criminal violations going back 30 years. The copied records include names and Social Security numbers.
The attackers also took nearly 30,000 active and inactive orders of protection, along with 150,000 reports dating back to 2010 from the Foster Care Review Board, which advises in cases where parents are alleged to be unfit or unable to care for a child. They did not take information about jurors, witnesses, or court employees.
Court technology staff shut the attack down on a backup server about two hours after spotting it on September 24. No records were altered or deleted, and the court says the data came off a highly compressed backup, so how much of it can actually be read is unclear. The FBI is investigating.
The court has notified those affected by text and email and is urging them to freeze their credit. Anyone holding a protective order does not need to refile — the orders remain valid. Court spokesperson Alberto Rodriguez said there's no evidence the data has been used or shared, and that no court cases have been affected or delayed.
Source: SecurityWeek
A cyberattack on Arizona's court system compromised personal information for 1.3 million people, believed to have started when a court employee clicked a malicious link in an email. Those 1.3 million were referred to the court's FARE debt collection program over unpaid fees, fines, and restitution for traffic and criminal violations going back 30 years. The copied records include names and Social Security numbers.
The attackers also took nearly 30,000 active and inactive orders of protection, along with 150,000 reports dating back to 2010 from the Foster Care Review Board, which advises in cases where parents are alleged to be unfit or unable to care for a child. They did not take information about jurors, witnesses, or court employees.
Court technology staff shut the attack down on a backup server about two hours after spotting it on September 24. No records were altered or deleted, and the court says the data came off a highly compressed backup, so how much of it can actually be read is unclear. The FBI is investigating.
The court has notified those affected by text and email and is urging them to freeze their credit. Anyone holding a protective order does not need to refile — the orders remain valid. Court spokesperson Alberto Rodriguez said there's no evidence the data has been used or shared, and that no court cases have been affected or delayed.
Source: SecurityWeek
ClickFix, the social engineering trick that fools users into pasting malicious commands into PowerShell, Windows Run, or the macOS Terminal, is evolving to dodge detection. Two new campaigns show attackers rebuilding the moment where a pasted command turns into a payload.
Flare researcher Assaf Morag detailed a campaign spreading CrocoRat — a remote access Trojan and crypto stealer. The victim still pastes a command from the clipboard, but that command now queries a DNS TXT record on an attacker-controlled server, and the record hands back the next PowerShell instruction. The next stage never touches the clipboard, so defenders have fewer forensics to work with.
Flare also found an unexecuted Python launcher in the package, built to choose its payload by environment: a quiet, persistent foothold on systems that look corporate, and the full RAT plus credential and crypto stealers on systems that look personal. The operator appears to be limiting theft on corporate targets to avoid tripping detection.
Microsoft Threat Intelligence flagged a separate cluster of compromised websites that pre-fetch a script into the browser cache, disguised as a PNG, before the fake prompt ever appears. That hides the payload and gets around the Run dialog's character limit. Morag's advice goes after the step itself: alert on clipboard-to-Run patterns, harden PowerShell script-block logging, stop interpreters running from writable directories, and train users on the tells — fake CAPTCHAs, press-Windows+R prompts, and verification-failed screens
Source: Dark Reading
ClickFix, the social engineering trick that fools users into pasting malicious commands into PowerShell, Windows Run, or the macOS Terminal, is evolving to dodge detection. Two new campaigns show attackers rebuilding the moment where a pasted command turns into a payload.
Flare researcher Assaf Morag detailed a campaign spreading CrocoRat — a remote access Trojan and crypto stealer. The victim still pastes a command from the clipboard, but that command now queries a DNS TXT record on an attacker-controlled server, and the record hands back the next PowerShell instruction. The next stage never touches the clipboard, so defenders have fewer forensics to work with.
Flare also found an unexecuted Python launcher in the package, built to choose its payload by environment: a quiet, persistent foothold on systems that look corporate, and the full RAT plus credential and crypto stealers on systems that look personal. The operator appears to be limiting theft on corporate targets to avoid tripping detection.
Microsoft Threat Intelligence flagged a separate cluster of compromised websites that pre-fetch a script into the browser cache, disguised as a PNG, before the fake prompt ever appears. That hides the payload and gets around the Run dialog's character limit. Morag's advice goes after the step itself: alert on clipboard-to-Run patterns, harden PowerShell script-block logging, stop interpreters running from writable directories, and train users on the tells — fake CAPTCHAs, press-Windows+R prompts, and verification-failed screens
Source: Dark Reading
ASOS customers woke up on Tuesday to a startling push notification — apparently sent by hackers who have compromised the fashion retailer's systems. The message, addressed to ASOS's data protection officer and IT team, claimed the attackers had "fully compromised the Snowflake instance" and threatened to leak the data unless the company engaged. App users in Australia, France, Sweden and Ireland received it too.
A group calling itself Xuanye Group took credit, linking to a freshly created Telegram channel. Dan Bird of security firm Horizon3 pointed out that sending a push notification needs access to ASOS's notification system, which is separate from Snowflake — so if both claims hold up, the attackers had credentials opening more than one door.
Snowflake says its own investigation has so far found no compromise of its platform. ASOS confirmed the unauthorised notification on Tuesday afternoon, said it immediately restricted access to the notification platforms, and told customers some basic personal information may have been accessed — but not payment cards or account passwords.
ASOS shares fell around a tenth on Tuesday. The company has not yet reported a breach to the UK's Information Commissioner's Office, and the National Cyber Security Centre has offered assistance. How many customers received the notification is still unclear.
Source: BBC News
ASOS customers woke up on Tuesday to a startling push notification — apparently sent by hackers who have compromised the fashion retailer's systems. The message, addressed to ASOS's data protection officer and IT team, claimed the attackers had "fully compromised the Snowflake instance" and threatened to leak the data unless the company engaged. App users in Australia, France, Sweden and Ireland received it too.
A group calling itself Xuanye Group took credit, linking to a freshly created Telegram channel. Dan Bird of security firm Horizon3 pointed out that sending a push notification needs access to ASOS's notification system, which is separate from Snowflake — so if both claims hold up, the attackers had credentials opening more than one door.
Snowflake says its own investigation has so far found no compromise of its platform. ASOS confirmed the unauthorised notification on Tuesday afternoon, said it immediately restricted access to the notification platforms, and told customers some basic personal information may have been accessed — but not payment cards or account passwords.
ASOS shares fell around a tenth on Tuesday. The company has not yet reported a breach to the UK's Information Commissioner's Office, and the National Cyber Security Centre has offered assistance. How many customers received the notification is still unclear.
Source: BBC News
