A Palo Alto VPN Bypass Patched in May Is Under Confirmed Attack, With Ransomware Use Reported, Plus a WordPress Plugin Exploited Before Its Flaw Had a Record and a CVSS 10 GitLab Flaw, With Hunts You Can Run Today
Palo Alto GlobalProtect CVE-2026-0257 (confirmed exploited, ransomware use known to CISA; end all VPN sessions after patching); Bricksforge CVE-2026-85097 (WordPress file upload exploited from 7 Oct); Power BI phishing that installs ScreenConnect; GitLab CVE-2026-97229 (CVSS 10.0, no exploitation stated); HPE ClearPass, ten critical flaws. Hunt packs in bash, PowerShell, Splunk SPL, KQL and osquery.