Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks

Multiple active threats and high-impact incidents reported: attackers are actively exploiting a PAN-OS GlobalProtect authentication bypass (CVE-2026-0257) to breach corporate networks, and an authentication bypass in FortiClient EMS (CVE-2026-35616) is being used to deploy an infostealer (EKZ). A new local Linux kernel privilege escalation called “CIFSwitch” can yield root on multiple distributions. Threat actors are also abusing ChatGPT share links to host fake outage pages to deliver malware, commercial DDoS-as-a-service markets and a 17M‑device botnet takedown were highlighted, and several大