Dutch Authorities Dismantle Botnet Linked to 17 Million Infected Devices

The Hacker News roundup reports a large-scale botnet takedown (at least 17 million infected devices) and multiple high‑risk vulnerabilities and active exploitation campaigns. Notable technical incidents include PAN-OS GlobalProtect authentication bypass under active exploitation (CVE-2026-0257), Marimo compromise followed by LLM-agent post‑exploitation (CVE-2026-39987), Gitea private image exposure (CVE-2026-27771), and SharePoint RCE (CVE-2026-45659). Other issues include a critical Gogs RCE (no CVE assigned), exploitation of FortiClient EMS to deliver credential theft malware (EKZ Infosteal​