Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility

Unit 42 published multiple research reports and threat briefs covering active exploitation and high-impact vulnerabilities, supply chain and cloud threats, and emerging malware campaigns. Notable items include active exploitation of PAN-OS CVE-2026-0257, a PAN-OS captive portal unauthenticated RCE (CVE-2026-0300), the critical Linux kernel local privilege escalation ‘Copy Fail’ (CVE-2026-31431), plus guidance on cloud logging abuse for defense evasion, npm supply chain risks, macOS FlutterShell malvertising, APT Screening Serpens activity, ROADtools misuse in cloud intrusions, AD CS abuse, and