Weekly Cybersecurity Roundup: PAN-OS Exploitation, Gogs Zero-Day and AI-Driven Campaigns
Summary
The roundup covers active exploitation of a PAN-OS flaw, an unpatched Gogs zero-day, GlassWorm C2 takedowns, CERT-In patching guidance, and campaigns involving AI, OAuth phishing and remote-access malware.
Key points
- Palo Alto Networks warned that CVE-2026-0257, an authentication bypass affecting certain PAN-OS and Prisma Access configurations, is being actively exploited.
- Rapid7 reported a critical Gogs zero-day that can enable remote code execution through malicious pull-request branch names; default-configured servers may be exposed, and no patch was available at publication.
- CrowdStrike, Google and Shadowserver took down GlassWorm’s four C2 channels on May 26, 2026, disrupting operator access to infected hosts; the article says the disruption may be temporary.
- CERT-In recommended patching actively exploited flaws on internet-facing or high-value systems within 12 hours where feasible, with longer indicative timelines for other critical and high-severity vulnerabilities.
- WithSecure said GREYVIBE, believed to be linked to Russian interests, extensively uses LLMs in attacks against private, government and military organizations in Ukraine.
- The roundup describes EvilTokens campaigns abusing the OAuth device authorization flow and RatPressto campaigns using compromised WordPress sites to deliver ScreenConnect for persistent access.
- Researchers described FROST, a browser-based SSD timing side channel that may reveal users’ website visits and application activity after they click a malicious link.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering actively exploited vulnerabilities, malware and phishing campaigns, and disruption of GlassWorm command-and-control infrastructure.
- Impact
- CVE-2026-0257 is being actively exploited to bypass authentication on affected PAN-OS and Prisma Access configurations. CVE-2026-41089, a Windows Netlogon flaw, was also reported under active exploitation. A Gogs zero-day can enable authenticated attackers—or unauthenticated attackers on default-configured instances—to execute commands and access or alter hosted repositories; no patch was available at publication. The GlassWorm C2 takedown disrupted operator access to infected hosts and delivery of new commands. Other reported activity includes attacks targeting Ukrainian organizations, credential-focused phishing, and remote-access malware deployments.
CVE
CVE-2026-0257Palo Alto Networks · PAN-OS; Palo Alto Networks · Prisma Access; +1 morePalo Alto Networks warned that CVE-2026-0257 is being actively exploited in PAN-OS and Prisma Access.CVE-2026-41089Microsoft · Windows Server 2012; Microsoft · Windows Server 2012 (Server Core installation); +10 moreNew Windows Flaw Under Attack – Belgium’s Centre for Cybersecurity (CCB) has warned that a recently patched Windows flaw, CVE-2026-41089, has come under active exploitation in the wild.
People
Threat Actors
bandcamproA solo Russian-speaking threat actor tracked by Trend Micro; the article reports a shift to AI-automated content, fraud, and credential theft beginning in September 2025.GREYVIBEA previously undocumented group reported to use large language models in attacks against private, government, and military organizations in Ukraine to gather intelligence. WithSecure said its activity aligns with Russian state interests but noted possible ties to the cybercrime ecosystem.
Malware
GlassWorma critical zero-day in Gogs, and a Windows Netlogon flaw, alongside takedowns and campaigns involving GlassWorm, GREYVIBE, EvilTokens, and RatPressto.NightSpireNew Payload Ransomware Emerges – Cybersecurity researchers have analyzed ransomware families like NightSpire and Payload, with the latter already racking up 50 victims on its leak site since emerging in February 2026.Nimbus RATIt was followed by the deployment of a Java-based remote access trojan (RAT) named Nimbus RAT.PAYLOADNew Payload Ransomware Emerges – Cybersecurity researchers have analyzed ransomware families like NightSpire and Payload, with the latter already racking up 50 victims on its leak site since emerging in February 2026.
Vendors
DashlaneDashlane Warns of Brute-Force Attack – Dashlane said: “user accounts were targeted in a brute force attack by an external party, resulting in the suspension of those accounts as part of Dashlane’s built-in securityGoogleCrowdStrike, Google, and Shadowserver disrupted the GlassWorm malware operation by taking down its C2 channels.MetaWeb Informer and ZachXBT, Instagram is said to have suffered from an exploit that made it possible to use Meta AI to reset passwords to accounts with no multi-factor authentication (MFA) enabled.MicrosoftPhishing and malware campaigns are abusing AI, OAuth device flow, Microsoft Teams, Google Drive, and compromised WordPress sites.Palo Alto NetworksPalo Alto Networks warned that CVE-2026-0257 is being actively exploited in PAN-OS and Prisma Access.
Products
GlobalProtectThis week’s roundup highlights active exploitation of a PAN-OS GlobalProtect authentication bypass, a critical zero-day in Gogs, and a Windows Netlogon flaw, alongside takedowns and campaigns involving GlassWorm,Gogshighlights active exploitation of a PAN-OS GlobalProtect authentication bypass, a critical zero-day in Gogs, and a Windows Netlogon flaw, alongside takedowns and campaigns involving GlassWorm, GREYVIBE, EvilTokens,Google DrivePhishing and malware campaigns are abusing AI, OAuth device flow, Microsoft Teams, Google Drive, and compromised WordPress sites.Google Sheets“Nimbus RAT is a self-contained implant that uses Google Drive and Google Sheets for command-and-control (C2), helping its network traffic appear benign,” eSentire said.InstagramInstagram Exploit Allegedly Enabled Account Takeover – According to Dark Web Informer and ZachXBT, Instagram is said to have suffered from an exploit that made it possible to use Meta AI to reset passwords to accountsMeta AIInformer and ZachXBT, Instagram is said to have suffered from an exploit that made it possible to use Meta AI to reset passwords to accounts with no multi-factor authentication (MFA) enabled.Microsoft Quick Assistthe use of Microsoft Teams voice phishing to deceive the victim into granting remote access via Quick Assist.Microsoft TeamsPhishing and malware campaigns are abusing AI, OAuth device flow, Microsoft Teams, Google Drive, and compromised WordPress sites.Microsoft Windowsactive exploitation of a PAN-OS GlobalProtect authentication bypass, a critical zero-day in Gogs, and a Windows Netlogon flaw, alongside takedowns and campaigns involving GlassWorm, GREYVIBE, EvilTokens, andNetlogonexploitation of a PAN-OS GlobalProtect authentication bypass, a critical zero-day in Gogs, and a Windows Netlogon flaw, alongside takedowns and campaigns involving GlassWorm, GREYVIBE, EvilTokens, and RatPressto.PAN-OSThis week’s roundup highlights active exploitation of a PAN-OS GlobalProtect authentication bypass, a critical zero-day in Gogs, and a Windows Netlogon flaw, alongside takedowns and campaigns involving GlassWorm,Prisma AccessPalo Alto Networks warned that CVE-2026-0257 is being actively exploited in PAN-OS and Prisma Access.ScreenConnectthreat actors have also been found to establish persistent remote access to compromised hosts through ScreenConnect deployments, which could then be leveraged for follow-on activity, such as data theft, lateral
Tools
Countries
Armeniaand Ireland, road police portals in Bulgaria and Armenia, tax authorities in Greece, and T-Mobile users in the United States,” the company said.Bulgariaand Ireland, road police portals in Bulgaria and Armenia, tax authorities in Greece, and T-Mobile users in the United States,” the company said.Egypt“Although the group initially claimed only a limited number of victims, its operations quickly showed a global footprint, with targets across Egypt, Mexico, and Poland,” Dark Atlas said.Greeceand Ireland, road police portals in Bulgaria and Armenia, tax authorities in Greece, and T-Mobile users in the United States,” the company said.IndiaCERT-In Urges Organizations to Patch Exploited Flaws Within 12 Hours – Organizations in India have been urged to patch actively exploited vulnerabilities impacting internet-facing or “crown jewel” systems within 12Irelandand Ireland, road police portals in Bulgaria and Armenia, tax authorities in Greece, and T-Mobile users in the United States,” the company said.Mexico“Although the group initially claimed only a limited number of victims, its operations quickly showed a global footprint, with targets across Egypt, Mexico, and Poland,” Dark Atlas said.Poland“Although the group initially claimed only a limited number of victims, its operations quickly showed a global footprint, with targets across Egypt, Mexico, and Poland,” Dark Atlas said.UkraineGREYVIBE is using large language models in attacks against organizations in Ukraine.United Statesand Ireland, road police portals in Bulgaria and Armenia, tax authorities in Greece, and T-Mobile users in the United States,” the company said.
Industries
Governmenthas been found to make extensive use of large language models (LLMs) in its attacks against private, government, and military organizations in Ukraine.LegalMicrosoft Teams and Google Drive Abused to Deliver Java RAT – An intrusion targeting a customer in the legal industry involved the use of Microsoft Teams voice phishing to deceive the victim into granting remote accessMilitaryto make extensive use of large language models (LLMs) in its attacks against private, government, and military organizations in Ukraine.