Threats Day Bulletin: PAN-OS RCE, Mythos cURL Bug, AI Tokenizer Attacks, and 10+ Stories
Summary: Palo Alto Networks released its first round of fixes for CVE-2026-0300, a critical buffer overflow in the PAN-OS User-ID Authentication Portal service that lets an unauthenticated attacker execute arbitrary code with root privileges via specially crafted packets. The company said the flaw has been exploited in limited attacks since at least last month by unknown threat actors dropping payloads including EarthWorm and ReverseSocks5.
Bottom line: An unauthenticated, root-level flaw in a perimeter service that is already being exploited means the window between patch and compromise is measured in days, and the payloads observed so far are the kind that establish quiet, persistent access rather than noise.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-0300
- Related
- CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability Known Exploited Vulnerabilities · May 06, 2026