CYBER THREATCAST

Treat CVE-2026-0257 as an emergency across Palo Alto Networks PAN-OS GlobalProtect and Prisma Access: identify exposed portals and gateways, apply the available vendor remediation, and investigate VPN sessions that may appear legitimate. Qilin, INC and other ransomware groups are actively using the flaw to bypass authentication and MFA, steal credentials, move laterally, exfiltrate data and deploy ransomware.

Patch BeyondTrust Remote Support for CVE-2026-102764 immediately and review remote-support access for evidence of compromise predating disclosure. ARMORY CASTLE reportedly exploited the vulnerability for nearly seven weeks before disclosure and patching, so installing the fix alone may not address systems already accessed—particularly at U.S. organizations operating the affected product.

Upgrade Siemens Software Center to version 4.0.9.8 and investigate systems running 3.5.8.7 for trojanized installers, malicious helper files and LegionLoader. Attackers are exploiting unsafe DLL loading by pairing a genuine signed Siemens executable with malicious files; Siemens found no evidence that its own systems or update infrastructure were breached.

Update every internet-facing Plex Media Server to version 1.43.3.10861 or later and investigate outdated hosts for cryptocurrency miners or Linux proxy backdoors. Attackers began exploiting the Plex2Shell chain within 24 hours of public proof-of-concept release, gaining unauthenticated remote code execution against exposed installations running earlier versions.

Isolate exposed VMmanager 6 nodes, assess customer virtual-server disks for unauthorized access, and rotate passwords, SSH and API keys, cloud tokens and cryptocurrency credentials that were stored on affected systems. Attackers mounted FirstVDS customer disks for covert collection, and no complete fix was available as of October 20; prior interim patches were reportedly insufficient.