Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks

Multiple active threats and notable security developments: attackers are actively exploiting a PAN-OS GlobalProtect authentication bypass (CVE-2026-0257) to breach corporate networks, and a FortiClient EMS authentication bypass (CVE-2026-35616) is being abused to deploy an info-stealer (EKZ). A new Linux local privilege escalation dubbed “CIFSwitch” can yield local root on multiple distributions. Threat actors are abusing ChatGPT share links to host fake outage pages that deliver malware, while GreyVibe and other groups are using AI-generated lures; an Android RAT service (BTMOB) provides a ph