Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

CIRCL OSINT Feed

Threatpost

ThreatFox MISP Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Active exploitation of PAN-OS vulnerability CVE-2026-0257 targets GlobalProtect portal and gateway components. This authentication bypass flaw allows unauthorized attackers to circumvent security controls and establish VPN connections. Ransomware operators including Spikey Scorpius (Qilin), Tarnished Scorpius (Inc), and Settra ransomware actors exploit this vulnerability to gain initial network access. Post-exploitation activities include bypassing multi-factor authentication, internal reconnaissance, lateral movement via RDP and SMB, credential harvesting, and ransomware deployment. Sophisticated tactics involve pivoting to the virtualization layer, accessing vCenter management appliances, disabling ESXi hypervisor security controls, and offline credential dumping from domain controller virtual disks. Multiple industries have been impacted. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.

CVE-2026-0257 is an authentication bypass vulnerability in PAN-OS affecting GlobalProtect portal and gateway components. Exploitation allows unauthorized attackers to establish VPN connections without proper authentication. Threat actors, including ransomware groups Spikey Scorpius (Qilin), Tarnished Scorpius (Inc), and Settra, actively exploit this flaw to gain initial access. After exploitation, attackers bypass multi-factor authentication, perform internal reconnaissance using remote monitoring tools, move laterally using RDP and SMB protocols, and stage tools for credential harvesting and ransomware deployment. Advanced techniques include pivoting to virtualization infrastructure by accessing vCenter management appliances, disabling security controls on ESXi hypervisors, and performing offline credential dumping against domain controller virtual disks. The exploitation has affected multiple industries. No patch or official remediation information is provided in the source data.

Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.

Active exploitation of PAN-OS vulnerability CVE-2026-0257 targets GlobalProtect portal and gateway components. This authentication bypass flaw allows unauthorized attackers to circumvent security controls and establish VPN connections. Ransomware operators including Spikey Scorpius (Qilin), Tarnishe

Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257

Threats Tagged 'virtualization layer attack'