Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution

Unit 42 highlights multiple high-impact threats: a PAN‑OS User‑ID Authentication Portal buffer‑overflow zero‑day allowing unauthenticated remote code execution (CVE-2026-0300); a widespread, critical Linux kernel local‑privilege‑escalation dubbed “Copy Fail” (CVE-2026-31431) enabling stealthy root access; and observed exploitation attempts against TP‑Link command‑injection (CVE-2023-33538). Additional reporting covers npm supply‑chain risks (wormable/multi‑stage attacks), high‑risk AI browser extensions that exfiltrate data, AirSnitch Wi‑Fi bypasses, active TGR‑STA‑1030 operations in Central/S