Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. The vulnerability affects the PAN-OS management interface and lets authenticated attackers with network access execute code as root on vulnerable devices. Palo Alto Networks confirmed in a security advisory published Wednesday that it has seen limited exploitation of the flaw in attacks. "Very limited exploitation has been observed targeting the Palo Alto Networks management interface," the company said. The vulnerability has a severity score of 8.6 and affects PA-Series and VM-Series firewalls, as well as Panorama virtual and M-Series appliances. Palo Alto says Cloud NGFW and Prisma Access are not affected. To exploit the vulnerability, attackers need existing credentials and network access to the PAN-OS management interface.
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for
Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates. The Always On VPN remote access solution replaced the legacy DirectAccess technology and works with domain-joined, non-domain-joined, and Microsoft Entra ID–joined Windows 10, Windows 11, and Windows Server devices. Always On VPN runs in the background and automatically establishes a secure tunnel back to the corporate network whenever a device connects to the internet. As Microsoft first acknowledged in a service alert sent to IT administrators in late September, the bug triggered Always On VPN failures if the initial connection fails (e.g., when using automatic protocol selection with IKEv2 and SSTP) on up-to-date systems running Windows 11 24H2 and later.
AI-powered penetration testing can uncover complex attack paths, but safety restrictions and network limitations leave many assets and vulnerabilities untested. Picus Security explains how combining agentic pentesting with exposure validation and breach simulation can help close these gaps.
A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. Since the start of the year, more than 750 million malicious messages have been aimed at Microsoft customers via email and SMS texts. Following an investigation initiated by Microsoft and Japan’s National Police Agency (NPA) into a wave of fraudulent activity, "a sprawling Chinese-language cybercrime marketplace" was discovered, with tools and services for phishing campaigns. The investigators traced the malicious activity to YAM Store (Storm-3119), an underground infrastructure marketplace, then linked it to the CoGUI, Haozi, and Iron Man System phishing kits, collectively tracked as Storm-2990.
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks.
OpenAI employee charged with planting hidden audio recorders to capture sensitive discussions about AI research and company strategy. On September 30, OpenAI staff found a small audio recording device jammed into a USB port on the back of a television in an executive conference room in their San Francisco office. The device had been there since September 28, its contents were encrypted, and whoever put it there had wrapped it in toilet paper to hide it. Federal prosecutors named the man as Abdulrahman Alfozan, 35, a Saudi national who’d been working on OpenAI’s product team since July 2025. Alfozan was fired and arrested on October 9. He faces up to five years in prison and a $250,000 fine if convicted. “An employee of OpenAI has been arrested for and charged with using or endeavoring to use an electronic, mechanical, or other device to intercept oral communications.” states DoJ. “Abdulrahman Alfozan, 35, a national of the Kingdom of Saudi Arabia, was arrested on Oct. 9, and made his initial appearance in federal court today.” The executive conference room hosted meetings about confidential research, product plans, business deals, government relations, and OpenAI’s technical progress. These were clearly sensitive discussions. FBI Director Kash Patel said the alleged goal was to spy on conversations about the company’s intellectual property. “According to the complaint unsealed today, Abdulrahman Alfozan allegedly concealed a covert recording device inside his employer’s executive conference room to secretly capture sensitive communications about the company’s super intelligence technology,” said FBI Director Kash Patel. “Protecting American SI innovation is essential to safeguarding our nation’s economic strength and national security, and the FBI views that mission as one of our highest counterintelligence priorities. Thank you to Director of National Intelligence Jay Clayton and our law enforcement partners for their support — and we will continue working closely with our partners across the U.S. government and private sector to keep American businesses and citizens safe and to ensure our country maintains its competitive edge.” Alfozan had no permission to enter the room or attend meetings there. CCTV footage showed him near the conference room several times before the recording device was discovered. On October 5, five days after OpenAI found it, cameras captured him looking behind the same television where the device had been hidden. He appeared to be checking on it or preparing to retrieve it. Before the device was installed on September 28, Alfozan used an internal OpenAI tool to search for office addresses, meeting rooms and their capacity, room calendars, the locations of executives and senior leaders, and schedules for meetings with external partners. These searches suggest he was gathering information about the company’s facilities and activities. Investigators also found a series of chatbot prompts submitted between September 24 and 30 through an account linked to Alfozan’s spouse. The account shared several identifiers with his own. The prompts covered how to build a continuous audio recorder, configure Wi-Fi, improve recording and live listening quality, encrypt an SD card, and enable remote access. Prosecutors also noted that on September 27 and 28, the account submitted prompts referring specifically to the custom header and unique MAC address of Recording Device 1. This happened just one day before the device was installed. On October 5, the same day Alfozan was caught on camera looking behind the television, he also left a bag unattended in a different room in an OpenAI building. Security staff opened it and found another recording device similar to the first one, along with his wallet and ID. So either he was planning to plant a second device, or he was already carrying a spare. “If convicted, Alfozan faces a maximum penalty of 5 years in prison and a $250,000 fine, followed by 3 years of supervised release.” concludes DoJ. OpenAI said it used its own internal AI models to help analyze the device, which TechCrunch reported “contained advanced encryption, audio monitoring capabilities, and a mechanism for transferring data designed to evade monitoring.” OpenAI also confirmed there’s no indication that Alfozan accessed or exfiltrated model weights, source code, or customer data through any other channel. This case is being prosecuted under National Security Presidential Memorandum 11, specifically tied to protecting American superiority in what the government is now formally calling “super intelligence” technology. The Director of National Intelligence, Jay Clayton, weighed in personally, calling AI development a national security prerogative. That framing, a straightforward wire tap case dressed in super intelligence language, tells you something about where this administration sees AI in the broader geopolitical picture. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, OpenAI)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability. The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS
Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud. Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking
Unit 42 dissects a cyberattack targeting a European bank's IT infrastructure, delivering concrete defense strategies to help organizations detect and counter comparable threats. The post The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk appeared first on Unit 42.
Confirm this action.
Leaving now will discard your changes.