Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution

Unit 42 released multiple research briefs including an active exploitation of a PAN‑OS captive portal zero‑day (CVE-2026-0300) — a buffer overflow enabling unauthenticated remote code execution — and a separate critical Linux kernel local privilege escalation dubbed “Copy Fail” (CVE-2026-31431). Additional coverage highlights escalating npm supply‑chain threats, high‑risk AI browser extensions that steal data, AirSnitch Wi‑Fi bypasses, AWS Bedrock/AgentCore sandbox and IAM weaknesses, Kubernetes attack trends, and attempted exploitation of TP‑Link router vulnerability CVE-2023-33538.