Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks

Multiple high-impact security stories: attackers are actively exploiting a PAN-OS GlobalProtect authentication bypass (CVE-2026-0257) to attempt network breaches. A local Linux kernel privilege-escalation vulnerability dubbed “CIFSwitch” can allow forging CIFS auth key descriptions and gaining root on multiple distributions. Threat actors are also abusing ChatGPT share links to host fake outage pages delivering malware, and exploiting a FortiClient EMS authentication bypass (CVE-2026-35616) to deploy an undocumented credential stealer named EKZ. Additional reporting covers DDoS-as-a-Service, a