Palo Alto's May advisory reports exploit attempts on a GlobalProtect VPN bypass for cookie-enabled firewalls
Palo Alto Networks' May 13, 2026 advisory for CVE-2026-0257 rates the 7.8-score GlobalProtect bypass at highest urgency after limited exploit attempts. Exposure needs authentication override cookies plus a specific certificate setup, and the fix costs users one re-login.
Publishers:security.paloaltonetworks.com
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives
- Not scored
- Confidence60
Palo Alto Networks patched CVE-2026-0322 (CVSS 8.6), a PAN-OS management RCE it says is under limited exploitation. CISA gave federal agencies until October 17; exploiting it takes a valid login and network access to the management interface.
Perspective Coverage
5 publishers
- Builder
- Builder 8%
- Operator
- Operator 80%
- Investor
- Investor 12%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence80
Fake red-team markers disguised intrusions into government Linux systems, Unit 42 says
Unit 42 tracks CL-UNK-1211, which hit government Linux systems from October 2025 to April 2026 and planted fake red-team markers. Unit 42 has not determined whether a state or a criminal group is behind it.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+10
- Incentives45
- Confidence55
CISA added four exploited flaws in PAN-OS, Cisco Secure Email Gateway and AhsayCBS to KEV with an October 17 federal deadline. We would take the Cisco gateway first, then AhsayCBS servers already patched once, then PAN-OS.
Perspective Coverage
3 publishers
- Builder
- Builder 20%
- Operator
- Operator 75%
- Investor
- Investor 5%
Reality
- Evidence80
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence78
OpenAI is reportedly in early talks to buy Trail of Bits, with no price disclosed. Crypto Briefing reported that CrowdStrike fell about 3% to around $254 on Oct. 14, Palo Alto about 4% and Fortinet more than 3%.
Perspective Coverage
5 publishers
- Builder
- Builder 24%
- Operator
- Operator 26%
- Investor
- Investor 50%
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+30
- Incentives
- Not scored
- Confidence55
Ransomware actors exploit Palo Alto GlobalProtect bypass CVE-2026-0257, ReliaQuest reports
ReliaQuest reports ransomware actors are exploiting CVE-2026-0257, an authentication bypass in Palo Alto PAN-OS GlobalProtect and Prisma Access. The Bedrock Agents credential flaw Zenity found is already fixed.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence55
Compromised credentials were enough at a European bank's vendor-managed gateway, Unit 42 reports
Unit 42 says compromised credentials were enough to enter a European bank through a third-party-managed gateway not set to enforce strict authentication. It judged the actor opportunistic, though the months of activity looked like espionage.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+20
- Incentives70
- Confidence55
UK ministers commit frontier AI to hunting flaws in government systems
UK AI minister Kanishka Narayan said on October 12 that government will use frontier AI to find flaws in its systems, after hackathons found over 400 flaws. The fix-time fall from 50 days to eight is credited to a central monitoring service.
Reality
- Evidence35
- Adoption25
- Hype gap+30
- Incentives55
- Confidence55
Iranian-linked hackers used a chicken coop camera to watch Israeli forces on the Lebanon border
Israel's National Cyber Directorate traced a hijacked chicken coop camera to Iranian-linked hackers, the Wall Street Journal reported. Pro-Ukraine and Russian operators run the same collection, but this account ties factory passwords only to the Israeli case.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+25
- Incentives20
- Confidence50
Tel Aviv's exchange bets that a rising New York revenue bar will send Israeli unicorns home
Tel Aviv Stock Exchange CEO Ittai Ben-Zeev is pitching Israeli unicorns to list at home in a year of a record 30 IPOs, Semafor reported. He puts New York's IPO revenue bar at $500 million, five times the old level, and the test is whether any company above it lists in Tel Aviv alone.
Reality
- Evidence40
- Adoption30
- Hype gap+30
- Incentives85
- Confidence45
Qilin and Settra ransomware crews are using a PAN-OS VPN bypass disclosed in May
ReliaQuest says Qilin and Settra ransomware groups are exploiting CVE-2026-0257, a PAN-OS GlobalProtect auth bypass disclosed May 13. Upgrading closes the entry point, but sessions opened before the upgrade may survive it.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence55
Anthropic announced a Critical Infrastructure Defense Program that pairs Claude with outside security firms, CrowdStrike among them. Alongside it, Anthropic is running a free, opt-in scanning service for open-source maintainers directly, CyberScoop reported.
Perspective Coverage
9 publishers
- Builder
- Builder 42%
- Operator
- Operator 37%
- Investor
- Investor 21%
Reality
- Evidence66
- Adoption38
- Hype gap+12
- Incentives70
- Confidence64
buildOne report1 publisher Anthropic's Cyber Mission targets the months between finding a bug and fixing it
Anthropic's Cyber Mission puts Claude models, engineers and funding behind bug fixing, after Glasswing finds often waited months for a patch. Its free OSS Scanner sends unreviewed reports that Anthropic expects to be over 90% accurate, so it suits maintainers who have time to verify them.
Reality
- Evidence40
- Adoption20
- Hype gap+10
- Incentives55
- Confidence40
Unit 42 finds supply-chain malware fetching its C2 addresses from blockchain smart contracts
Unit 42 says supply-chain attackers have moved command-and-control into blockchain smart contracts, so one transaction can re-point an entire botnet or worm. Defenders' useful choke points are now developer machines, CI runners and the chain lookup itself.
Reality
- Evidence55
- Adoption45
- Hype gap+15
- Incentives45
- Confidence55
Full OT visibility still leaves 49 percent of operators struggling with legacy equipment
Palo Alto Networks found 49 percent of critical infrastructure operators who see every OT asset still list legacy equipment as a challenge. Most respondents say their security tools, seven on average at large operators, have raised complexity and cost.
Reality
- Evidence35
- Adoption18
- Hype gap+15
- Incentives
- Not scored
- Confidence40
Unit 42 ties fake coding challenges from Dubai Airports to an Iranian campaign in Iraq
Palo Alto's Unit 42 says an Iranian state-aligned actor it tracks as CL-STA-1178 posed as the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets. Its report ties attacks other vendors reported one at a time into one campaign that hit Iraqi critical infrastructure in March 2026.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+15
- Incentives60
- Confidence45
buildOne report1 publisher Palo Alto Networks' Cortex XCOR keeps engineers approving what its root-cause agents recommend
Palo Alto Networks launched Cortex XCOR, built by its January Chronosphere acquisition, to root-cause outages with AI agents that default to human sign-off. For on-call teams that makes it a faster first investigator, with a person still approving each fix.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+30
- Incentives75
- Confidence40
Omnissa hires Palo Alto Networks veteran Amit Singh to steer its endpoint software toward AI agents
Omnissa has named former Palo Alto Networks president Amit Singh CEO, effective immediately, to push its 15,000-customer endpoint business toward AI agents. His plan stretches the management software already on customers' devices to cover AI agents too, so buyers would get agent controls from a vendor they already use.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+45
- Incentives70
- Confidence40
Nasdaq rises 0.45% for the week, led by AI demand, as payrolls miss by 55,000
September payrolls of 29,000, against an 84,000 consensus, lifted the Nasdaq 1.2% on Friday and turned a losing week into a 0.45% gain. Every major index was down through Thursday, so the AI-led advance depends on the Fed staying on hold.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives70
- Confidence50
Okta's earnings multiple gained 32 turns while cRPO growth gained two points
Okta's forward earnings multiple went from about 18x to about 50x in five months while its full-year EPS guide rose about 2%. That ties the price as much to investors' view of AI security stocks as to Okta's own forward bookings.
Reality
- Evidence55
- Adoption40
- Hype gap+35
- Incentives
- Not scored
- Confidence50
Earlier coverage
- Palo Alto Networks built a service on the Anthropic model that found 75 flaws in its own products
Invest · September 30, 2026 · Confirmed2 publishers
- Palo Alto Networks runs AI-agent network policy on NVIDIA BlueField processors
Security · September 29, 2026 · Confirmed2 publishers
- OpenAI took about two months to learn its agents had breached an Australian Medicare-data service
Invest · September 27, 2026 · Confirmed18 publishers
- 405 AI malware samples, 12 sightings: Unit 42's own count argues against an AI defence line item
Security · August 25, 2026 · Confirmed2 publishers
- CrowdStrike and Fortinet co-sign a letter that dates the security tooling they sell
Product · August 27, 2026 · Confirmed5 publishers
- Check Point co-signs a cyber defense letter whose only named product belongs to OpenAI
Security · August 27, 2026 · Confirmed5 publishers
- Shai-Hulud spreads by bumping a version number your dependency range already accepts
Build · August 31, 2026 · Confirmed2 publishers
- AI agents ran more than 50 ATT&CK techniques through one enterprise in under 10 hours
Security · September 2, 2026 · Confirmed2 publishers
- Spring Ring impersonated the help desk over external Teams accounts to relay NTLM at domain controllers
Security · August 31, 2026 · Confirmed3 publishers
- Island's $6.4 billion round prices the company at 32 times revenue
Invest · September 25, 2026 · Confirmed3 publishers
- Fake Claude Max giveaway harvests Google logins through a window it draws itself
Security · September 23, 2026 · Confirmed2 publishers
- Legora's CEO calls a European frontier AI lab wishful thinking
Product · September 22, 2026 · One report1 publisher
- CrowdStrike Stock Jumps 13.8% to Record High as AI-Safety Fears Boost Cybersecurity Sector
Invest · September 14, 2026 · Confirmed3 publishers
- OpenAI, Anthropic and 100+ others urge governments to fund defenses against AI-enabled cyberattacks
Invest · August 30, 2026 · Confirmed8 publishers