A new round of security disclosures covers everything from unauthenticated remote code execution to a WordPress backdoor that repairs itself after removal.
Qilin and Settra ransomware operators are exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026. ReliaQuest noted that access arrives through the victim's own VPN and can look like ordinary remote work until credential theft or ransomware deployment begins. Recommended steps include patching, disabling authentication override cookies where unneeded, terminating active GlobalProtect sessions, and investigating unexpected connections.
An Adobe Experience Manager chain combines four flaws - unauthenticated DAM bulk import, stored XSS, unsafe XML parsing, and Groovy execution via /bin/asynccommand - to reach unauthenticated RCE. Only the cloud version was affected, and patches are out. Samsung patched CVE-2026-110392 (CVSS 9.8) in QA-Board, an unauthenticated RCE flagged by Claude Opus 5.5.
Researcher Ziyi Guo disclosed CVE-2026-47595 (Bad UVM, CVSS 7.5) in NVIDIA's Linux GPU Display Driver, where memory permissions are not preserved, letting an unprivileged user write to read-only memory and potentially escape a container. Infoblox analyzed Noir, a wallet-drainer kit that uses DNS TXT records over public DoH services to locate its backend pool on Cloudflare Pages; it needs no seed phrase or private key and is suspected to be AI-assisted.
Other items: a Rust RAT called CikaBika Bot delivered via LNK and PDF lures and using Discord for C2; KGB RAT, marketed since late 2025 with screamers, jump scares, and forced blue screens; BotHelper RAT, a .NET implant with live screen surveillance; Google's Android anti-scam rollout, which has blocked over 3 million spoofed bank calls since June 2026; Anthropic's claim that new measures cut distillation harvesting by 90-99%; Firefox Enterprise; a self-healing WordPress plugin using EtherHiding on Ethereum; Meta notifying about 1,500 people after stolen credentials exposed GitHub repositories; XWorm's expansion to 46 plugins; higher Chrome memory-safety bounties; Microsoft's post-quantum PKI warning; Warden Stealer, CastleStealer, and Aoki targeting AI tool credentials; an SSRF in Harbor (CVSS 8.5); active exploitation of CVE-2026-106931 in SiteGuard; an unpatched SQL injection in WebAlliance (CVSS 9.8); NSD patches; Xen's CVE-2026-79610 race condition; and SYSTEM-level RCE in MyReport Updater 2.1.1.
Source: The Hackers News