Qilin exploits CVE-2026-0257 in PAN-OS GlobalProtect to breach VPNs
The Qilin ransomware operation is abusing CVE-2026-0257, an authentication bypass vulnerability in PAN-OS GlobalProtect, to gain unauthorized access to corporate networks. The flaw affects GlobalProtect portals and gateways and especially impacts unpatched systems, which remain exposed even when the perimeter appears well protected. Palo Alto Networks fixed the issue in May, but attackers have shown that VPN systems remain a…
Read the article →
Ransomware on Japan’s cold chain
A ransomware attack hit a Japanese food logistics company, causing delays and disruptions in the distribution chain for frozen products to thousands of customers. Among those affected are said to be major restaurant chains,…
Read the article →
Alert overload is slowing SOCs, pushing defenders toward outcome-based operations
A Rapid7 executive argues that adding more alerts to a security operations center can actually slow response instead of improving it. The core problem is that attackers increasingly use stolen credentials and legitimate tools…
Read the article →
Healthcare, medtech, and service providers are still a favorite ransomware and breach target
Healthcare and adjacent service providers continue to be hit by both ransomware and large data breaches. The feed includes multiple incidents involving clinics, insurers, medical device manufacturers, and healthcare support organizations, often with sensitive…
Read the article →
Ransomware and extortion operations continue to target organizations worldwide
Ransomware leak sites and reporting showed continued activity from groups such as Qilin, DragonForce, Akira, Play, Incransom, and others against companies, schools, hospitals, and public-sector organizations across many countries. The articles themselves were sparse,…
Read the article →
The Russian cyber ecosystem faces escalating sanctions and enforcement actions
The U.S., UK, and EU widened sanctions and enforcement actions against Russian-linked cybercriminals, bulletproof hosting operators, and state-aligned actors. Officials said these networks were involved in ransomware enablement, cyber sabotage, and broader destabilization campaigns…
Read the article →
SonicWall SMA1000 zero-days are actively exploited in ransomware attacks
SonicWall disclosed that attackers are actively exploiting two zero-day vulnerabilities in its SMA1000 appliance line, and one of the flaws is a critical SSRF issue that can be used by unauthenticated remote attackers. The…
Read the article →