Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution

Unit 42 reports an actively exploited PAN‑OS User‑ID Authentication Portal buffer‑overflow zero‑day (CVE-2026-0300) that enables unauthenticated remote code execution against affected PAN‑OS devices; immediate patching and mitigations are recommended. The feed also highlights Copy Fail (CVE-2026-31431), a critical Linux kernel local‑privilege‑escalation impacting millions, and additional high‑risk themes including npm supply‑chain threats, malicious AI browser extensions, Kubernetes/cloud risk, and ongoing regional actor activity.