Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257

Palo Alto Unit 42 published multiple threat briefs and research posts covering active exploitation and high-impact vulnerabilities (notably PAN-OS CVE-2026-0257 and PAN-OS captive portal CVE-2026-0300) and the critical Linux kernel local privilege escalation CVE-2026-31431 (“Copy Fail”). Additional coverage includes macOS malvertising distributing the FlutterShell backdoor, npm supply-chain threats and wormable malware, evolved stealers (Gremlin), TamperedChef trojanized apps, misuse of ROADtools for cloud intrusions, Iranian APT Screening Serpens campaigns, AD CS certificate-service abuse, MS