The IT Nerd

Multiple ransomware groups have been exploiting a vulnerability in Palo Alto Networks’ PAN-OS firewall software since June, according to an updated Unit 42 threat report. The authentication bypass flaw, CVE-2026-0257, allows attackers to establish unauthorized VPN connections and bypass multifactor authentication.

Unit 42 identified Qilin and INC ransomware operators exploiting the vulnerability, with additional reports linking Settra ransomware to the attacks. Investigations span healthcare, financial services, manufacturing, government, energy and other industries.

Once inside corporate networks, attackers have moved laterally, harvested credentials and deployed ransomware. In one case, attackers accessed VMware vCenter, disabled ESXi security controls and extracted domain credentials directly from a virtual disk, bypassing endpoint security tools.

Palo Alto Networks patched the vulnerability in May and recommends that organizations update affected systems and investigate potential compromises.

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“Security appliances are now one of the most consistently exploited category of enterprise technology, and the Qilin and INC ransomware crews working a Palo Alto Networks PAN-OS authentication bypass since June is the pattern repeating, not an anomaly. The devices organizations buy to defend the perimeter have become the most productive way through it. When I analyzed CISA’s Known Exploited Vulnerabilities (KEV) catalog in July, security and network infrastructure vendors accounted for over a quarter of actively exploited entries in the first half of 2026, with 75 entries flagged as ransomware entry points and Palo Alto Networks holding 6 of them. An appliance is internet-facing by design, holds elevated network trust, and runs closed software no endpoint agent watches, so the compromise is invisible to the security stack because the compromised device is the security stack. That is how attackers reached vCenter, disabled ESXi controls, and pulled domain credentials without tripping a single tool. Treat the firewall as an adversary-accessible endpoint, and segment so a compromised gateway cannot reach everything behind it.”

ㅤ

Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security:

“It’s never good to see this happen to anyone, especially a respected industry leader like Palo Alto Networks. But this incident highlights a much broader challenge facing our industry. In the post-Mythos era of AI-accelerated vulnerability discovery, we no longer have the luxury of relying on point-in-time security assessments. We must accelerate proactive offensive testing and, equally important, remediation and independent verification to keep pace with evolving threats. This doesn’t eliminate the need for experienced security professionals. Quite the opposite. It amplifies their importance while demanding better tools and automation to operate at scale. The attackers’ reported movement from VPN access into virtualization infrastructure also reminds us that security must be validated across the entire architecture, not just individual controls. Ultimately, discovering vulnerabilities faster means little if we cannot fix them just as effectively. Otherwise, we’re simply getting better at finding problems we haven’t solved.”

Besides patching all the things, this is not good as a lot of people depend on Palo Alto firewalls. Thus this is a today problem.

Nearly 60% of critical infrastructure organizations experienced a significant cybersecurity incident in the past year, while widespread gaps in OT visibility, legacy infrastructure and IT/OT integration continue to complicate security, according to Palo Alto Networks’ new State of Critical Infrastructure Cybersecurity Report.

The report surveyed more than 1,600 security leaders across manufacturing, healthcare and life sciences, energy and utilities, transportation, and government and public sector organizations in 11 countries. Among the findings:

• 68% do not have complete, real-time visibility into all assets connected to their OT networks.
• An average of 23% of connected OT assets are unmanaged or difficult to monitor.
• 42% identify legacy, unpatchable OT assets as their biggest cybersecurity risk.
• 59% experienced a significant security breach in the past year, with one in five affected multiple times.
• Among organizations experiencing incidents, 50% cited safety concerns, 49% unplanned downtime, 46% production disruption and 46% financial losses.
• Unplanned downtime costs organizations an average of $288,563 per hour.
• 74% have not fully integrated their IT and OT security operations.
• Only 37% have comprehensive OT asset visibility, while 40% have virtual patching or other compensating controls for vulnerable assets.
• 95% are concerned about Frontier AI-powered attacks targeting critical infrastructure, while 91% expect AI-driven cybersecurity to play a role in defending against them.
• 84% expect 5G to be widely or extensively adopted within their organizations over the next two to three years.

The report also found that organizations use an average of seven disparate security systems and tools. Fifty-nine percent said multiple systems create operational complexity, 56% reported higher operating costs and 41% said tool sprawl contributes to delayed incident response.

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“Critical infrastructure security is constrained by assets that cannot be taken offline long enough to patch, while geopolitical tensions and expanding connectivity increase pressure on providers already working with limited resources.

“Palo Alto Networks’ 2026 State of Critical Infrastructure Cybersecurity Report connects that pressure to real operational consequences, including safety concerns, unplanned downtime, production disruption, and financial losses. The common thread is incomplete visibility across legacy systems, unmanaged devices, private 5G networks, and other connected assets. Separate IT and OT security teams, along with multiple disconnected tools, make the response slower and harder to coordinate.

“The burden is heavier for utilities, hospitals, manufacturers, transport operators, and government agencies because they cannot treat cybersecurity as a normal software-maintenance exercise. A security team may know that a programmable logic controller (PLC) is vulnerable, but still lack a reliable answer to the question that matters operationally, which pump, production step, or safety process does it control? Without that context, a vulnerability score cannot tell the team what to protect first.

“Time-to-protection is the meaningful measure for unpatchable OT. Passive asset discovery, network segmentation, strict remote access, and virtual patching can block exploitation while engineering teams test a vendor fix and schedule a safe maintenance window.

“AI will compress the attacker’s timeline while defenders are still establishing what a connected asset does, what it controls, and whether it can be safely changed. Constrained headcount makes that gap harder to close. AI can multiply a small team’s reach, but safe use still requires people who understand the model, the network, and the physical process. A facility without that technical talent could turn automation into another unmonitored dependency. For providers facing geopolitical pressure and constrained resources, connecting every alert to the physical process that asset controls is the priority.”

Damon Small, Board of Directors, Xcape, Inc.:

“Operational disruptions averaging nearly $290,000 per hour in downtime highlight the staggering financial risks of operational technology (OT) vulnerabilities. The convergence of OT and IT networks has been underway for nearly three decades, yielding tangible business efficiencies while simultaneously introducing severe cyber threats. Early examples of targeted OT attacks date back to the 2000s and have steadily escalated in frequency and sophistication. Today, legacy and unpatchable devices combined with fragmented security operations leave defenders blind to over two-thirds of their connected environments. Rather than chasing hype around emerging threat vectors, security leaders must prioritize foundational controls: continuous passive network monitoring to establish real-time asset inventories, strict network segmentation to isolate vulnerable systems, and unified identity enforcement across IT and OT boundaries.”

“Critical Takeaways:

• Unplanned downtime from OT security incidents costs organizations an average of $288,563 per hour.
• Decades of IT and OT convergence leave 68% of critical infrastructure security leaders without real-time visibility into connected assets.
• Effective defense requires prioritizing basic controls like network segmentation and passive monitoring over speculative AI threat vectors.

“Buying a seventh security tool will not fix the fact that nobody knows what is plugged into the OT network.”

John Strand, Owner, Black Hills Information Security, Inc.:

“This is unfortunately what we should expect when we look at a lot of these organizations. What you’re seeing is technological spread. Organizations have a tremendous amount of legacy technology that can’t simply be ripped out and replaced. At the same time, newer and more secure technologies are being introduced, but that doesn’t mean they’re evenly distributed across the organization. There’s that great quote, ‘The future is already here. It’s just not evenly distributed.’ I think this story is a perfect example of that.

“What worries me even more is the coming age of AI, where people can create applications and SaaS services incredibly quickly without necessarily knowing how to code. I believe the technical complexity of these environments is going to increase, not decrease. And complexity is the enemy of computer security. Security teams are going to be dealing with new technologies being deployed incredibly quickly, legacy technologies that were never properly secured, and constant pressure to get things into production as fast as possible. All of those problems become even more pronounced when you get into SCADA, ICS, and OT environments.”

Critical infrastructure should be treated as critical. Which means that any and all measures should be taken to secure it 100% of the time. Otherwise adversaries will pwn it 100% of the time.

Today, Palo Alto Networks announced it will give defenders access to OpenAI’s leading cybersecurity-focused model, GPT-5.6 Daybreak, to help businesses find, test, and validate attack paths at machine speed. Until now, GPT-5.6 Daybreak has not been available for commercial use.

Frontier AI in cybersecurity has largely been seen as a threat defenders were racing against. Now, Palo Alto Networks’ Unit 42 is expanding its Frontier AI Defense service to bring advanced AI cyber models inside customer environments to actively simulate attacks and uncover hidden, previously unknown attack paths and create custom remediation plans before AI-enabled threat actors can exploit them.

What’s New 

Through our partnership with OpenAI, we’re expanding our Frontier AI Exposure Analysis capabilities to offer security teams: 

• Leading cyber models: Apply the latest advanced cyber models to improve exposure discovery, testing and validation.
• Multi-model harness: Use the right model for the right task to improve efficacy, expand coverage and optimize cost.
• Exposure discovery: Find vulnerabilities, misconfigurations, leaked credentials, unmanaged attack surface and other posture gaps across applications and network assets.
• Advanced adversary simulation: Actively test exploitability and validate end-to-end attack paths to understand how an attacker could compromise the environment.
• Custom remediation plan: Prioritize the fixes that break the most important attack paths and feed those findings into existing IT, development and security workflows.

Focusing on known vulnerabilities and exploits doesn’t work anymore. Our Frontier AI Defense data found that 36% of exposures lacked known CVEs. Security teams must now match AI-powered attacks with machine-speed defense.

There’s also the blog post from Sam Rubin, SVP of Unit 42, with more details.

Palo Alto Networks’ Unit 42 researchers have identified a Chinese-speaking threat actor using the DeepSeek AI model with the open-source Hermes Agent framework to autonomously scan, exploit and compromise vulnerable internet-facing servers with limited human involvement.

The activity was uncovered after the attacker’s AI agent accidentally exposed its own infrastructure, revealing API keys, exploit scripts, target lists and attack logs.

According to the researchers, the AI agent operated in an autonomous “Yolo” mode that allowed it to execute commands without requiring operator approval. The system was used to identify vulnerable targets, launch exploits and automate post-exploitation tasks.

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs Had This To Say:

“Unit 42 caught this campaign because the AI agent accidentally started a file server from the attacker’s home directory and exposed everything. API keys, exploit scripts, target lists, session logs. The competent campaigns don’t self-expose.

“This was an unsophisticated operator with poor operational security. No zero-day discovery, no zero-day deployment. Every exploit was a public proof-of-concept pulled from GitHub for known Common Vulnerabilities and Exposures (CVEs).

“The entire stack was off-the-shelf, with DeepSeek as the reasoning engine, Hermes Agent for orchestration, and FOFA, a Chinese internet asset search engine similar to Shodan, connected through a Model Context Protocol (MCP) server. In one session with no further human input, the agent surveyed deployment counts across ten product families, selected the highest-value CVE by severity score and target volume, downloaded the exploit code, and started scanning.

“A single operator in Zhuhai attempted exploitation against over 460 systems across seven CVEs. The autonomous portion failed because target-side configurations happened to block the exploit chain. Happened to. A slightly less secure default on those n8n workflow automation instances and this would be a breach disclosure, not a research paper.

“That’s the unsophisticated version with commodity tooling and public exploits. A more capable threat actor running this same workflow discovers and deploys zero-days autonomously, without a human ever reviewing the exploit chain. When that capability intersects with ICS environments, the consequences shift from data theft to physical damage.

“I’ve built a Shodan MCP integration in about 30 minutes with an AI coding agent, and industrial control system (ICS) protocol MCP servers in a couple of hours. The attacker used a jailbroken DeepSeek instance, but they didn’t need to. I run Opus 4.6 for offensive security work, and it doesn’t stop you. The older and even open-source models are plenty strong with a solid harness around them. The barrier to autonomous hacking at scale is an afternoon and an API key or a decent GPU.

“This campaign burned through public CVEs with off-the-shelf tooling and still nearly succeeded. The next iteration finds zero-days on its own. Every quarter these models get more capable and cheaper to run. Organizations that aren’t aggressively shrinking their external attack surface and investing in detection and incident response now are going to learn that from an autonomous agent instead of a research paper.”

If I were you, I would look to see if you are a potential target. Because if you don’t, your adversaries will.

Palo Alto Networks has disclosed a critical vulnerability in multiple PAN-OS versions, tracked as CVE-2026-0300 (CVSS 9.3), that allows unauthenticated remote attackers to execute arbitrary code with root privileges on affected firewalls. The flaw is a buffer overflow vulnerability impacting the User-ID Authentication Portal service on PA-Series and VM-Series firewalls.

Palo Alto confirmed the vulnerability is being actively exploited in limited attacks, specifically targeting systems where the Authentication Portal is exposed to untrusted IP addresses or the public internet. 

Palo Alto said fixes will begin rolling out starting May 13, with additional patches planned later in the month. Until patches are available, the company is advising organizations to restrict Authentication Portal access to trusted internal networks or disable the feature entirely if not required. Prisma Access, Cloud NGFW, and Panorama are not affected.

Underscoring how critical this is, the CISA has added the vulnerability to its KEV catalog May 6th.

Jacob Warner, Director of IT, Xcape, Inc.:

   “The disclosure of CVE-2026-0300 is a sobering reminder that the network edge remains the highest-value target for state-sponsored espionage. By the time Palo Alto Networks released this advisory, the suspected threat actor CL-STA-1132 had already spent nearly a month refining their exploit, moving from failed attempts on April 9 to successful root RCE by mid-April. This is not a theoretical vulnerability; it is an active, surgical operation where attackers are using the firewall’s own nginx processes to drop tunneling tools like EarthWorm and ReverseSocks5.

   “For leadership, the takeaway is that a “critical” CVSS score on a firewall often means the attacker is already behind your lines before the alert even fires. With patches not arriving until May 13, the only viable defense is immediate exposure reduction. If your User-ID Authentication Portal is reachable from the public Internet, you are essentially providing an unauthenticated root shell to anyone with the right packet sequence. You must audit your Interface Management Profiles now: restrict portal access to trusted internal zones and ensure that “Response Pages” are disabled on all Internet-facing interfaces. In 2026, if you aren’t actively shrinking your edge attack surface, you’re just waiting for the next zero-day to do it for you.

   “This bug was a zero-day for 26 days before we even gave it a name. In the time it took us to get an advisory, the bad guys were already halfway through the Active Directory.”

Denis Calderone, CTO, Suzu Labs:

   “This one is a little different from the management interface exposures we’ve been warning about with other edge devices like Fortinet, SonicWall, and Cisco. This vulnerability is in the User-ID Authentication Portal, which is the page users hit to authenticate through the firewall. In a lot of deployments, that portal is internet-exposed on purpose because that’s how it’s designed to work. That makes the mitigation more complicated than just “take it off the internet,” because for some organizations, it’s there for a reason.

   “That said, there are a lot of environments where the exposure isn’t necessary. If your Authentication Portal is used for local captive portal authentication, guest WiFi, or BYOD segments, it only needs to be reachable from those specific interfaces. Restrict it to those zones and block everything else. If the portal serves branch offices or remote sites over SD-WAN or site-to-site tunnels, you can restrict access to known source IP ranges for those branches. You don’t need to open it to the entire internet just because some of your traffic originates externally.

   “The harder scenario is organizations using the portal for VPN-less remote authentication, where users could be connecting from anywhere. You can’t restrict by source IP in that case. Those organizations need to look at migrating remote users to GlobalProtect or Prisma Access, both of which are not affected by this CVE. If that’s not possible before May 13, enable Threat ID 510019 if you have a Threat Prevention subscription on PAN-OS, and understand that you’re carrying real risk until the patch drops.

   “Nation-state actors have had nearly a month with this one. They’ve been deploying tunneling tools and cleaning logs immediately after compromise. If your Authentication Portal has been internet-exposed, don’t just apply the workaround and move on. Assume compromise and hunt for it.”

Rajeev Raghunarayan, Head of GTM, Averlon:

   “CVE-2026-0300 is an unusual situation: active exploitation confirmed, added to KEV, and for many systems there is no patch available yet. The only immediate option is to restrict the Authentication Portal to trusted internal zones or disable it entirely. The silver lining is that the vulnerable service is not enabled by default, and organizations following best practice by keeping the Authentication Portal restricted to trusted internal networks are at much lower risk.

   “A perimeter firewall is a gateway into the environment. When the gateway is owned, access is owned. With root-level access on a perimeter control point, the concern is no longer just the vulnerable service itself, but the visibility, access, and control that position can provide into the systems behind it.

   “Even for organizations that have already applied the workaround, the important question is what was potentially exposed during that window and what activity should now be treated as suspicious.”

Given how long this has been out there, and the fact that it is being exploited, this is a drop everything and patch now sort if thing. Which is of course the worst kind of situation to be in.

Palo Alto Networks Unit 42 announced a partnership with Kevin Mandia‘s new offensive security company Armadin, to scale ability to identify and remediate AI-driven exposures and better protect organizations.

You can read all the details here: Unit 42 Expands Frontier AI Defense with Armadin Partnership

Palo Alto Networks has shared new research regarding how effective autonomous AI offensive capabilities are against cloud environments. While Unit 42 did not use frontier AI models in testing, this research is a crucial look at how powerful AI models may ultimately be weaponized in cyberspace.

Building on the November 2025 Anthropic disclosure that showed AI acting as the operator in an espionage campaign, Unit 42 answers the question: Can AI systems operate autonomously end-to-end to attack cloud environments, or do they still require human guidance?

Unit 42’s research & findings include:

• Unit 42 created “Zealot,” a multi-agent penetration testing proof-of-concept designed to see if AI could independently take down a hardened cloud environment without any human oversight.
• In sandboxed GCP tests, the multi-agent system autonomously executed a full attack chain, including: Server-Side Request Forgery (SSRF) exploitation, Metadata service credential theft, service account impersonation and privilege escalation and BigQuery data exfiltration.
• AI-driven attacks have reached functional maturity and current LLMs can chain attacks with minimal human guidance. The window between initial access and data loss is shrinking as tools like Zealot leverage misconfigurations faster and more consistently than a human attacker. 
• However, creating a purely autonomous multi-agent cyber attack was not entirely possible (manual oversight was needed to prevent the AI from irrelevant rabbit-holing).
• Current security detection models optimized for human attack patterns will struggle to catch agent-based operations that chain actions across services in seconds.

You can read the research here: https://unit42.paloaltonetworks.com/autonomous-ai-cloud-attacks/

The release of the newest frontier AI models marks a turning point for cybersecurity. Late last week, Palo Alto Networks chief product & technology officer Lee Klarich published a stark warning about what this means for the industry. 

Some additional context:

• Palo Alto Networks conducted early testing of the latest frontier AI models, including Anthropic’s Mythos model as part of Project Glasswing and OpenAI’s latest models as part of the Trusted Access for Cyber program. 
• As a result of that testing, Lee contends we are officially moving from AI-assisted threats to autonomous, AI-driven attacks. The resulting “vulnerability deluge” means human-speed security is no longer enough.
• Palo Alto Networks launched Unit 42 Frontier AI Defense. Instead of waiting for an AI-driven attack, this new service proactively finds and validates an organization’s exposures using the latest frontier AI models before adversaries do, transforming security in the process.

You can read more here: https://www.paloaltonetworks.com/blog/2026/04/defenders-guide-frontier-ai-impact-cybersecurity/

Palo Alto Networks Unit 42 published new research on a security flaw in Google’s Vertex AI Engine,

Unit 42 researchers found that Google Cloud’s Vertex AI Engine is giving AI agents far too much access by default. This critical discovery highlights the challenges of applying foundational security standards in the AI era.

Key Takeaways:

• Significant Insider Threat: The research details how Google Cloud’s Vertex AI Engine is giving AI agents far too much access, by default. The report reveals that a misconfigured or compromised AI agent deployed via Google Cloud Platform’s (GCP) Vertex AI Agent Engine can be weaponized to compromise an organization’s cloud environment. This level of access constitutes a significant security risk, transforming the AI agent from a helpful tool into a potential insider threat.
• The Big Picture: The rapid deployment of AI agents introduces a whole new class of overprivileged insiders. This comes as 90% of organizations are already facing pressure to loosen access control to support AI-driven automation.

You can read the research here:http://unit42.paloaltonetworks.com/double-agents-vertex-ai