Threats Day: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Summary: This week's ThreatsDay bulletin reports Qilin and Settra ransomware groups actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026, with ReliaQuest noting the access arrives through the victim's own VPN and can resemble legitimate remote work. Other items include a DNS TXT record-based wallet drainer kit called Noir, the KGB RAT sold on underground forums since late 2025 with screamer and forced-blue-screen features, and Meta notifying about 1,500 people after stolen employee credentials were used to break into some of its GitHub repositories.
What's compelling: ReliaQuest warns that patching alone may not remove access established before remediation, so an authentication bypass exploited through your own VPN can persist past the fix. KGB RAT subscriptions run from $150 for one month to $800 for a year, putting hidden desktop takeover, credential theft, and ransomware within reach of low-budget actors.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-0257
- Related
- Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) Cyber Risks · Oct 20, 2026CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability Known Exploited Vulnerabilities · May 29, 2026