⚡ Weekly Recap: Linux Rootkit, macOS Crypto Stealer, Web Socket Skimmers and More

Summary: Attackers have weaponized CVE-2026-6973, an improper input validation flaw in Ivanti Endpoint Manager Mobile (EPMM) that lets authenticated users with administrative privileges run code remotely, and are actively exploiting a zero-day memory corruption vulnerability, CVE-2026-0300, in the PAN-OS authentication portal that allows unauthenticated attackers to run code with root privileges on PA-Series and VM-Series firewalls. Censys detected about 263,000 internet-exposed hosts running PAN-OS, and patches for the Palo Alto flaw are expected starting May 13, 2026, with possible exploitation attempts dating to April 9, 2026.
What you should know: About 263,000 internet-exposed PAN-OS hosts face an unauthenticated root-level flaw with no patch until May 13, 2026, and neither Ivanti nor Palo Alto Networks disclosed when exploitation began or how many customers were affected.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-68670 CVE-2026-0073 CVE-2026-0300 CVE-2026-1046 CVE-2026-20034 CVE-2026-20035 CVE-2026-2005 CVE-2026-2006 CVE-2026-20185 CVE-2026-20188 CVE-2026-22679 CVE-2026-23863 CVE-2026-23864 CVE-2026-23866 CVE-2026-23870 CVE-2026-23918 CVE-2026-26129 CVE-2026-26164 CVE-2026-29014 CVE-2026-29146 CVE-2026-29201 CVE-2026-29202 CVE-2026-29203 CVE-2026-32710 CVE-2026-33111 CVE-2026-33309 CVE-2026-42248 CVE-2026-42249 CVE-2026-42778 CVE-2026-42779 CVE-2026-43284 CVE-2026-43500 CVE-2026-44573 CVE-2026-44574 CVE-2026-44575 CVE-2026-44578 CVE-2026-44579 CVE-2026-44843 CVE-2026-4670 CVE-2026-5174 CVE-2026-5865 CVE-2026-6973 CVE-2026-7482 CVE-2026-7896 CVE-2026-7897 CVE-2026-7898
Related: Progress Patches Critical MOVEit Automation Bug Enabling Authentication Bypass Cyber Risks ·
16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems Cyber Risks ·
Dirty Decrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability Cyber Risks ·