A Palo Alto VPN Bypass Patched in May Is Under Confirmed Attack, With Ransomware Use Reported, Plus a WordPress Plugin Exploited Before Its Flaw Had a Record and a CVSS 10 GitLab Flaw, With Hunts You Can Run Today

At a glance: fixes and indicators

Written for organizations and the teams who defend them. IoC = evidence it already happened (an address, an account, a log line). IoA = the behavior of an attack in progress. Network IoCs are defanged: remove the square brackets before using them. Indicators age fast, so re-check the source before blocking.

Highest payoff today — analysis. Most of these items sit on an access or management surface that rarely needs to be open to everyone: a VPN portal's cookie feature, a plugin's form endpoint, a policy server's web interface, a CI/CD configuration. For all of them, the single most useful move is shrinking who can reach it or which features are on. For the phishing item, it is the reverse question: which remote-management tools do you approve, and does anything else count as an alert?

How to use this. A published-IoC hit means compromise: handle it under the item's defined response. An IoA hit alone is a lead to validate (PIVCCERL™'s Validation stage). An empty IoC row is not reassurance. The hunt packs say what to do on a hit and what a clean result means.

1. Palo Alto GlobalProtect: a VPN authentication bypass patched in May is under confirmed attack, and ransomware use is on record

Indicators

What

Per Palo Alto's advisory (published 13 May, FAQs added 3 June; the CVE record was updated 14 July), CVE-2026-0257 (CVSS 4.0 7.8, CWE-565, reliance on cookies without validation) lets an unauthenticated attacker bypass authentication on a GlobalProtect portal or gateway when authentication override cookies are enabled and the cookie certificate is shared with another feature. Rapid7's analysis is that the appliance trusted the decrypted cookie contents without verifying a signature, so anyone holding the relevant public key could forge one. Rapid7 saw its first exploitation on 17 May and a second wave on 21 May, assessed to be one actor from a consistent spoofed MAC address; in 8 of 10 affected customers a forged cookie was accepted without a full VPN session, and in some wave-two cases a VPN address was assigned; it saw no lateral movement. Palo Alto's advisory states that it "has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied" (exploitation status updated 29 May; the advisory metadata lists exploit maturity as "ATTACKED"), and Unit 42's 9 June brief says a proof of concept was released on 29 May. What is new in this window: ReliaQuest, as reported by Cyber Security News (11 October) and GBHackers (12 October), names Qilin and Settra as exploiting the flaw, describes Cobalt Strike, BloodHound and SharpHound in related intrusions, and advises ending all GlobalProtect sessions after patching because patching does not evict access gained earlier. We have not seen ReliaQuest's own post; the actor names, tooling and the three addresses above are as those two outlets carried it, and neither dates the observations. The flaw is in CISA's catalog (added 29 May 2026, federal due date 1 June, ransomware use "Known"; catalog version 2026.10.08). Fixed builds per Palo Alto: PAN-OS 12.1.7 or 12.1.4-h6; 11.2.12, 11.2.10-h7, 11.2.7-h14 or 11.2.4-h17; 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32 or 11.1.4-h33; 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36 or 10.2.7-h34; Prisma Access 10.2.10-h36 or 11.2.7-h13. Rapid7 reports Palo Alto's original score was 4.7 (medium), raised to 7.8 on 29 May, and urged treating the flaw as critical; and CISA's assessment lists exploitation as active.

So what

A password-less VPN session is the cheapest way in an attacker can buy, and it looks like a remote worker in the logs. The conservative reading is that an unpatched, exposed GlobalProtect with override cookies on has been tried since May, that ransomware crews are using it, and that "we patched in June" answers only half the question: whoever came in earlier may still hold a session, a credential or a foothold. Keep in mind that in 8 of the 10 customers Rapid7 saw affected, forged cookies were accepted without a full VPN session, so a log line is not proof of access either way.

Now what — P (Preparation); P → I → V for any estate that ran an exposed override-cookie configuration before patching; analysis

• Who patches it: your own firewalls or Palo Alto's cloud. Self-managed PAN-OS (hardware, virtual machines and cloud-marketplace images you run, with or without Panorama) is yours to upgrade; nothing happens until you do it. Prisma Access is Palo Alto's hosted service: its advisory footnote says it "is being actively upgraded for all the customers as per the upgrade schedule shared with the customers", so if you only use Prisma Access, the odds are that Palo Alto has already patched it, but confirm in writing instead of assuming, and note that a hybrid setup also needs your on-premises firewalls upgraded (the advisory says you "must upgrade all on-premises next-generation firewalls"). Cloud NGFW and Panorama are not affected. Our experience is that Palo Alto does not show customers the hotfix ("-h") level of its hosted service, so ask your account team for the build and date it reached your tenant, ask them to make that visible to you in the customer portal, and ask them to commit in writing to telling you proactively when a future flaw affects you. This is our guidance, not something the advisory says.
• Configuration. In the portal's Agent configuration, authentication settings, and the gateway's client settings, check "Generate cookie for authentication override" and "Accept cookie for authentication override". Disable them if you do not need them, or give them a dedicated certificate used for nothing else. Upgrade every portal and gateway that generates or accepts cookies together, including on-premises firewalls in a hybrid Prisma Access setup, then terminate all active GlobalProtect sessions; users sign in once more because the fix changes cookie handling.
• Blast radius. Treat the VPN as an untrusted entry point: limit what the VPN address pool can reach, keep domain controllers, backups and management interfaces off it, and make sure a VPN login alone does not grant access to administrative systems. Rotate credentials for any account that was used from a session you cannot explain, and for any shared secret stored on the firewall if the box itself is suspect.
• Detection with a defined response. Run the hunt pack below over GlobalProtect logs back to 13 May, then look at what the matching session did next. Defined response: a login from a published address, a published host name or MAC address, or a cookie login to the local admin account is a confirmed intrusion path: end the session, preserve the logs and the firewall's tech-support file, hunt the address pool for Cobalt Strike, BloodHound and SharpHound activity, reset credentials the session could reach, and treat the network as one where a ransomware actor has had access. A "kali" host name alone is a lead: check what else that session did.
• Communication. If an MSP or MSSP runs your firewalls, ask in writing whether override cookies were enabled, which build each firewall runs, the date it was fixed, and whether sessions were ended afterward. Where a confirmed intrusion exists, ransomware-related notification clocks may already be running; decide now who calls counsel and your insurer.

Hunt pack — run it, then act on what it says

The indicators, field values and detection patterns are Rapid7's, Unit 42's and, where marked, ReliaQuest's as carried by two outlets; the searches are our analysis. The bash script was run against synthetic logs (an address-and-host-name hit, a clean log, a "kali" lead, a near-miss address and a look-alike account name that correctly do not match, a compressed hit and an empty input); the SPL and KQL were reviewed, not executed against a live platform. We are not offering Sigma, Suricata or YARA: no Sigma validator was available to us in this run, no network signature or file sample was published, and a rule written from a guess would be counted as a control it is not. Cookie logins are a normal feature, so the script flags a cookie login only when it is a success for an account named admin, which is a lead and not a verdict. GlobalProtect log formats differ by version and export, so field names in the queries are placeholders for your mapping. Remove the square brackets from addresses before running the SPL and KQL. Adjust field and table names to your logging.

#!/usr/bin/env bash
# Usage: ./globalprotect-hunt.sh LOGFILE...   (GlobalProtect / PAN-OS system or auth logs, syslog or CSV exports; plain or .gz) - read-only
# Exit 0 = scanned, no hits; 1 = hits; 2 = usage; 3 = nothing readable (NOT a clean result)
set -uo pipefail
[ $# -ge 1 ] || { echo "usage: $0 LOGFILE..." >&2; exit 2; }
zcat -f -- "$@" 2>/dev/null | python3 -c '
import sys, re
ips = ("104[.]207[.]144[.]154 146[.]19[.]216[.]119 146[.]19[.]216[.]120 146[.]19[.]216[.]125 209[.]99[.]191[.]137 79[.]130[.]26[.]202 "
       "23[.]128[.]228[.]6 179[.]43[.]172[.]213 185[.]195[.]232[.]139 198[.]12[.]106[.]60 202[.]144[.]192[.]47 "
       "216[.]245[.]184[.]150 216[.]245[.]184[.]47 216[.]245[.]184[.]110").split()
ipre = re.compile(r"(?<![0-9.])(" + "|".join(re.escape(i.replace("[.]", ".")) for i in ips) + r")(?![0-9])")
names = re.compile(r"DESKTOP-GP01|GP-CLIENT|WINDOWS-LAPTOP-001|\bJocker\b|aa:bb:cc:dd:ee:ff|00:11:22:33:44:55", re.I)
kali = re.compile(r"(?<![a-z0-9])kali(?![a-z0-9])", re.I)
cookie = re.compile(r"cookie", re.I); ok = re.compile(r"success", re.I); admin = re.compile(r"(?<![a-z0-9])admin(?![a-z0-9])", re.I)
n = h = 0
for line in sys.stdin:
    n += 1
    why = []
    if ipre.search(line): why.append("IOC-address")
    if names.search(line): why.append("IOC-hostname-or-mac")
    if kali.search(line): why.append("LEAD-kali-hostname")
    if cookie.search(line) and ok.search(line) and admin.search(line): why.append("IOA-cookie-login-admin")
    if why: h += 1; print(",".join(why), "|", line.rstrip()[:240])
print(f"scanned={n} hits={h}", file=sys.stderr)
sys.exit(3 if n == 0 else (1 if h else 0))'

index=* (sourcetype=pan* OR sourcetype=*globalprotect*) earliest=-150d
  ("104[.]207[.]144[.]154" OR "146[.]19[.]216[.]119" OR "146[.]19[.]216[.]120" OR "146[.]19[.]216[.]125" OR "209[.]99[.]191[.]137" OR "79[.]130[.]26[.]202"
   OR "23[.]128[.]228[.]6" OR "179[.]43[.]172[.]213" OR "185[.]195[.]232[.]139" OR "198[.]12[.]106[.]60" OR "202[.]144[.]192[.]47"
   OR "216[.]245[.]184[.]150" OR "216[.]245[.]184[.]47" OR "216[.]245[.]184[.]110"
   OR "DESKTOP-GP01" OR "GP-CLIENT" OR "WINDOWS-LAPTOP-001" OR "Jocker" OR "aa:bb:cc:dd:ee:ff" OR "00:11:22:33:44:55"
   OR ("Cookie" "success" "admin"))
| stats count min(_time) AS first max(_time) AS last values(sourcetype) AS sources BY host
| sort - count

CommonSecurityLog
| where TimeGenerated > ago(150d)
| where DeviceVendor =~ "Palo Alto Networks"
| where SourceIP in ("104[.]207[.]144[.]154","146[.]19[.]216[.]119","146[.]19[.]216[.]120","146[.]19[.]216[.]125","209[.]99[.]191[.]137","79[.]130[.]26[.]202","23[.]128[.]228[.]6","179[.]43[.]172[.]213","185[.]195[.]232[.]139","198[.]12[.]106[.]60","202[.]144[.]192[.]47","216[.]245[.]184[.]150","216[.]245[.]184[.]47","216[.]245[.]184[.]110")
   or Message has_any ("DESKTOP-GP01","GP-CLIENT","WINDOWS-LAPTOP-001","Jocker","aa:bb:cc:dd:ee:ff","00:11:22:33:44:55")
   or AdditionalExtensions has_any ("DESKTOP-GP01","GP-CLIENT","WINDOWS-LAPTOP-001","Jocker","aa:bb:cc:dd:ee:ff","00:11:22:33:44:55")
   or (Message has "Cookie" and Message has "success" and Message matches regex @"(?i)(^|[^a-z0-9])admin([^a-z0-9]|$)")
| project TimeGenerated, DeviceName, SourceIP, Activity, Message
| order by TimeGenerated desc

2. Bricksforge: attackers were uploading PHP before the flaw had a public record

Indicators

What

Per Patchstack (article dated 8 October), the plugin checks a file's MIME type at upload but later trusts client-supplied metadata, in particular the url field of temporaryFileUploads. An attacker obtains a nonce from an unauthenticated AJAX action, uploads a GIF/PHP polyglot that passes the MIME check, then submits a form whose file path points at the image and whose url ends in a PHP extension; the plugin writes the content to the PHP location and the embedded code runs when that file is requested. Patchstack saw the first attempt at 21:47:17 UTC on 7 October, said its virtual-patching rule was live before the first attack, and did not attribute the activity to a specific actor, calling it consistent with automated exploitation. The CVE record (published 8 October 06:42 UTC, credit d.v4n_s3c) lists versions through 3.1.8.9 and a CVSS 3.1 score of 9.8; Patchstack and The Hacker News give 10.0, and we show both. Fixed version, where sources differ: Patchstack names 3.1.8.10; the vendor's changelog page lists 4.0.1 (8 October) with a note that it fixes a security issue in the Pro Forms file upload and that it affects every site with Pro Forms active "including sites whose forms use no upload fields", and did not list 3.1.8.10; The Hacker News gives both. We plan on the newest release, 4.0.1, and note that 4.0 is a major release worth testing first on a copy. The flaw is not in CISA's catalog (version 2026.10.08).

So what

Unauthenticated, remote and automated is the combination that gets scanned within hours, and here it was. A web shell on a WordPress host usually reaches the database credentials in wp-config.php, and often much more on a shared or multi-site server. The conservative reading is that any internet-reachable Bricksforge below the fixed release since 7 October has been tried, and that updating closes the door but does not remove a shell already inside.

Now what — P (Preparation); P → I → C for any site with a hit; analysis

• Configuration. Update Bricksforge. If you must wait, block POST /wp-json/bricksforge/v1/form_submit and the bricksforge_form_submit and bricksforge_regenerate_nonce AJAX actions at the web firewall, or deactivate the plugin until it is updated. On the host, deny PHP execution in wp-content/uploads/ at the web server; it breaks nothing legitimate and defeats this class of upload.
• Blast radius. A site with a hit should be treated as having exposed everything its PHP user could read: rotate the database password, WordPress salts, and any API keys or payment-gateway secrets in the configuration, and reset administrator passwords. Keep one site per hosting account or container where you can, so a shell on one site does not read another.
• Detection with a defined response. Run the hunt pack below. Defined response: a PHP file in the plugin's temporary folder, or a login_admin_*.php file, is a confirmed compromise: take the site out of service or behind a block page, preserve the web root and logs, restore from a backup taken before 7 October, then update and rotate. A request to the form endpoint with temporaryFileUploads and no file left behind is an attempt: block the source and confirm the version.
• Communication. If a web agency or host runs the site, ask in writing which Bricksforge version is installed, when it was updated, and whether they checked for PHP files in the uploads folder.

Hunt pack — run it, then act on what it says

The indicators, endpoints and paths are Patchstack's; the searches are our analysis. The two bash scripts were run against synthetic data (a log hit, a clean log, an empty log, a compressed hit, an address near-miss that correctly does not match, a document root with a planted .PHP5 file, one with a clean uploads folder and one with no uploads folder); the SPL, KQL and osquery were reviewed, not executed against a live platform. We are not offering Sigma, Suricata or YARA: no Sigma validator was available to us in this run, Patchstack published no network signature, and it published no sample strings for YARA, and a rule written from a guess would be counted as a control it is not. Many sites do not log POST bodies, so the log hunt can see the endpoint being called but often not temporaryFileUploads. Remove the square brackets from addresses before running anything. Adjust field and table names to your logging.

#!/usr/bin/env bash
# Usage: ./bricksforge-hunt.sh LOGFILE...   (web server / reverse-proxy / WAF logs; plain or .gz) - read-only
# Exit 0 = scanned, no hits; 1 = hits; 2 = usage; 3 = nothing readable (NOT a clean result)
set -uo pipefail
[ $# -ge 1 ] || { echo "usage: $0 LOGFILE..." >&2; exit 2; }
zcat -f -- "$@" 2>/dev/null | python3 -c '
import sys, re
ips = "177[.]75[.]57[.]20 23[.]97[.]62[.]146 84[.]247[.]60[.]125 38[.]154[.]185[.]97 150[.]109[.]16[.]166 153[.]75[.]90[.]146".split()
ipre = re.compile(r"(?<![0-9.])(" + "|".join(re.escape(i.replace("[.]", ".")) for i in ips) + r")(?![0-9])")
ioc = re.compile(r"/wp-content/uploads/(?:bricksforge/tmp/[^ \"?]*\.(?:ph[a-z0-9]*|phtml)|[0-9]{4}/[0-9]{2}/login_admin_[^ \"?]*\.php)", re.I)
ioa1 = re.compile(r"bricksforge_regenerate_nonce|bricksforge/v1/form_submit|action=bricksforge_form_submit", re.I)
ioa2 = re.compile(r"temporaryFileUploads", re.I)
n = h = 0
for line in sys.stdin:
    n += 1
    why = []
    if ipre.search(line): why.append("IOC-address")
    if ioc.search(line): why.append("IOC-php-in-upload-path")
    if ioa1.search(line): why.append("IOA-bricksforge-endpoint")
    if ioa2.search(line): why.append("IOA-temporaryFileUploads")
    if why: h += 1; print(",".join(why), "|", line.rstrip()[:240])
print(f"scanned={n} hits={h}", file=sys.stderr)
sys.exit(3 if n == 0 else (1 if h else 0))'

#!/usr/bin/env bash
# Usage: ./bricksforge-files.sh WP_ROOT...   (WordPress document roots) - read-only
# Lists PHP-type files where Bricksforge should never leave them. Exit 0 = none, 1 = found, 2 = usage, 3 = no wp-content/uploads found (NOT a clean result)
set -uo pipefail
[ $# -ge 1 ] || { echo "usage: $0 WP_ROOT..." >&2; exit 2; }
roots=0; hits=0
for r in "$@"; do
  u="$r/wp-content/uploads"
  [ -d "$u" ] || { echo "no uploads dir: $u" >&2; continue; }
  roots=$((roots+1))
  while IFS= read -r f; do hits=$((hits+1)); echo "FOUND | $f"; done < <(
    { [ -d "$u/bricksforge/tmp" ] && find "$u/bricksforge/tmp" -type f \( -iname '*.php*' -o -iname '*.pht*' -o -iname '*.phar' \) 2>/dev/null
      find "$u" -type f -iname 'login_admin_*.php' 2>/dev/null; } | sort -u)
done
echo "roots_scanned=$roots files_found=$hits" >&2
[ "$roots" -eq 0 ] && exit 3
[ "$hits" -gt 0 ] && exit 1 || exit 0

index=* sourcetype=*access* earliest=-30d
  ("bricksforge/v1/form_submit" OR "bricksforge_regenerate_nonce" OR "bricksforge_form_submit" OR "temporaryFileUploads"
   OR "bricksforge/tmp/" OR "login_admin_"
   OR "177[.]75[.]57[.]20" OR "23[.]97[.]62[.]146" OR "84[.]247[.]60[.]125" OR "38[.]154[.]185[.]97" OR "150[.]109[.]16[.]166" OR "153[.]75[.]90[.]146")
| stats count min(_time) AS first max(_time) AS last values(uri_path) AS paths values(status) AS statuses BY host, src_ip
| sort - count

DeviceFileEvents
| where Timestamp > ago(30d)
| where (FolderPath has "/uploads/bricksforge/tmp/" or FolderPath has "\\uploads\\bricksforge\\tmp\\")
        and FileName matches regex @"(?i)\.(php[0-9a-z]*|pht[a-z]*|phar)$"
   or FileName matches regex @"(?i)^login_admin_.*\.php$"
| project Timestamp, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName
| order by Timestamp desc

SELECT path, filename, size, datetime(mtime,'unixepoch') AS modified
FROM file
WHERE (path LIKE '/var/www/%/wp-content/uploads/bricksforge/tmp/%'
       AND (filename LIKE '%.php%' OR filename LIKE '%.pht%' OR filename LIKE '%.phar'))
   OR (path LIKE '/var/www/%/wp-content/uploads/%/%/login_admin_%.php');

3. Power BI links that install ScreenConnect, then a second remote-management tool

Indicators

What

Per Huntress (7 October), the lure is a Power BI public dashboard posing as a reference document; the "Download Reference" prompt opens an attacker-controlled site that fingerprints the visitor, reports through Telegram, delays, and then triggers a rogue ScreenConnect installer. Installers create multiple persistent clients, the attackers run a defense-evasion tool and scheduled tasks, and a retroactive hunt tied one rogue remote-management client's unique client ID and configuration to 22 further endpoints across separate incidents. Huntress gives no attribution and no IP addresses, and notes that abuse of Power BI public dashboards and multiple-RMM persistence are earlier tactics; the novelty is the trusted-domain lure, the fingerprinting and the delayed download. Huntress's recommendations are to review phishing protections for links on trusted cloud services, monitor for new or unapproved ScreenConnect installs and connections, watch for scheduled tasks and scripts tied to remote-access tools, restrict remote-management software to approved instances, and investigate hosts running multiple RMM clients.

So what

The link points at a real Microsoft domain, so a reputation filter and a cautious user both see a familiar name. After the click, the attacker holds a signed, legitimate remote-access tool, which many endpoint products treat as normal software. The durable control is not blocking Power BI; it is knowing which remote-management tools are yours.

Now what — P (Preparation); P → I → C for any host with an indicator; analysis

• Configuration. Allow-list the remote-management tools and ScreenConnect instances you use (by instance domain and, where your product supports it, by application control or EDR policy), and block or alert on every other instance. Add the domains above to your DNS or proxy blocklist. Where you do not use public Power BI sharing, consider whether staff need to open public Power BI links from email at all.
• Blast radius. Remote-access software runs with the user's rights or higher. Keep local administrator rights off standard users, separate administrative accounts from mail accounts, and rotate credentials the affected user could reach. Segment so that an endpoint cannot reach management interfaces of servers and backups directly.
• Detection with a defined response. Run the hunt pack below. Defined response: any of the listed domains, hashes, files or the scheduled task on a host is a confirmed compromise: isolate the host, preserve it, remove every remote-management client you did not install, reset the user's credentials and sessions, and review what the user and the host could reach. A second ScreenConnect client on a host where you use ScreenConnect is a lead to validate: compare its instance domain with your approved list before acting.
• Communication. Tell staff what a "reference document" link that triggers a download looks like, and give them one place to report it. If an MSP or MDR provider manages your endpoints, ask in writing whether they alert on unapproved ScreenConnect instances.

Hunt pack — run it, then act on what it says

The indicators and behaviors are Huntress's; the searches are our analysis. The bash script was run against synthetic logs (a hit, a clean log, an empty log, a compressed hit, a subdomain of a listed domain that correctly matches, and a look-alike domain that correctly does not); the SPL, KQL and PowerShell were reviewed, not executed against a live platform. We are not offering Sigma, Suricata or YARA: no Sigma validator was available to us in this run, and Huntress published no network signature or sample strings beyond the hashes and names above. Remove the square brackets from domains before running the SPL and KQL. Adjust field and table names to your logging.

#!/usr/bin/env bash
# Usage: ./powerbi-hunt.sh LOGFILE...   (DNS, proxy, firewall, EDR exports; plain or .gz) - read-only
# Exit 0 = no hits, 1 = hits, 2 = usage, 3 = nothing readable (NOT a clean result)
set -uo pipefail
[ $# -ge 1 ] || { echo "usage: $0 LOGFILE..." >&2; exit 2; }
zcat -f -- "$@" 2>/dev/null | python3 -c '
import sys, re
doms = "dailylifeproject[.]site burnsworth[.]site essaywritingservice[.]site openpediatrics[.]site check[.]vykyn[.]click hamham27[.]screenconnect[.]com instance-g01s1n-relay[.]screenconnect[.]com onthegotree[.]site".split()
domre = re.compile(r"(?<![a-z0-9-])(?:" + "|".join(re.escape(d.replace("[.]", ".")) for d in doms) + r")(?![a-z0-9-])", re.I)
hashes = "5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35".split()
hre = re.compile("|".join(hashes), re.I)
names = re.compile(r"SCAutoRepairEvery2Min|SCAutoFix\.ps1|HideUL_x64\.exe|LyN03DvVjUKPrun\.cmd|2b302081e9e777d0|43773b3da4ccb17b", re.I)
pbi = re.compile(r"app\.powerbi\.com/view\?r=", re.I)
n = h = 0
for line in sys.stdin:
    n += 1
    why = []
    if domre.search(line): why.append("IOC-domain")
    if hre.search(line): why.append("IOC-hash")
    if names.search(line): why.append("IOC-name")
    if pbi.search(line): why.append("IOA-powerbi-public-view-link")
    if why: h += 1; print(",".join(why), "|", line.rstrip()[:240])
print(f"scanned={n} hits={h}", file=sys.stderr)
sys.exit(3 if n == 0 else (1 if h else 0))'

index=* earliest=-60d
  ("dailylifeproject[.]site" OR "burnsworth[.]site" OR "essaywritingservice[.]site" OR "openpediatrics[.]site" OR "check[.]vykyn[.]click"
   OR "hamham27[.]screenconnect[.]com" OR "instance-g01s1n-relay[.]screenconnect[.]com" OR "onthegotree[.]site"
   OR "SCAutoRepairEvery2Min" OR "SCAutoFix.ps1" OR "HideUL_x64.exe" OR "LyN03DvVjUKPrun.cmd"
   OR "5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3" OR "f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35")
| stats count min(_time) AS first max(_time) AS last values(sourcetype) AS sources BY host
| sort - count

union
 (DeviceNetworkEvents | where Timestamp > ago(60d)
    | where RemoteUrl has_any ("dailylifeproject[.]site","burnsworth[.]site","essaywritingservice[.]site","openpediatrics[.]site","check[.]vykyn[.]click","hamham27[.]screenconnect[.]com","instance-g01s1n-relay[.]screenconnect[.]com","onthegotree[.]site")
    | project Timestamp, DeviceName, What = "network-ioc", Detail = RemoteUrl),
 (DeviceFileEvents | where Timestamp > ago(60d)
    | where FileName in~ ("SCAutoFix.ps1","HideUL_x64.exe","LyN03DvVjUKPrun.cmd")
        or SHA256 in ("5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3","f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35")
    | project Timestamp, DeviceName, What = "file-ioc", Detail = FolderPath),
 (DeviceProcessEvents | where Timestamp > ago(60d)
    | where FileName =~ "ScreenConnect.ClientService.exe"
    | summarize clients = dcount(FolderPath), paths = make_set(FolderPath, 10), last = max(Timestamp) by DeviceName
    | where clients > 1
    | project Timestamp = last, DeviceName, What = "multiple-screenconnect-clients (ours)", Detail = tostring(paths))
| order by Timestamp desc

# Reports indicators from the Huntress write-up on this host. Exit 0 = none, 1 = found. Read-only.
$found = 0
$task = Get-ScheduledTask -TaskName 'SCAutoRepairEvery2Min' -ErrorAction SilentlyContinue
if ($task) { $found++; "FOUND | scheduled task SCAutoRepairEvery2Min" }
foreach ($f in 'C:\Temp\ScreenConnect.ClientSetup.msi') { if (Test-Path -LiteralPath $f) { $found++; "FOUND | $f" } }
$names = 'SCAutoFix.ps1','HideUL_x64.exe','LyN03DvVjUKPrun.cmd'
foreach ($root in $env:TEMP,'C:\Temp','C:\Windows\Temp') {
  if (Test-Path -LiteralPath $root) {
    Get-ChildItem -LiteralPath $root -Recurse -File -ErrorAction SilentlyContinue |
      Where-Object { $names -contains $_.Name } | ForEach-Object { $found++; "FOUND | $($_.FullName)" }
  }
}
$sc = Get-CimInstance Win32_Service -ErrorAction SilentlyContinue | Where-Object { $_.PathName -match 'ScreenConnect Client' }
"screenconnect_clients=$(@($sc).Count) (compare each with your approved list)"
if (@($sc).Count -gt 1) { $found++; "LEAD | more than one ScreenConnect client on this host"; $sc | ForEach-Object { "  $($_.Name) | $($_.PathName)" } }
"indicators_found=$found"
if ($found -gt 0) { exit 1 } else { exit 0 }

4. GitLab: a CVSS 10.0 code-execution flaw in the CI/CD regular-expression compiler

Indicators

What

Per GitLab's patch-release page (8 October), all 24 fixes are in 19.2.8, 19.3.4 and 19.4.2. CVE-2026-97229 (critical, CVSS 10.0) is an integer overflow in the CI/CD regular-expression compiler that GitLab says allows code execution on the server via a crafted regular expression; GitLab's table marks it as reachable without authentication and lists affected versions as 19.1 onward, while CERT-EU (12 October) lists affected versions as those before 19.4.2, 19.3.4 and 19.2.8, and calls the attacker unauthenticated. GitLab's page lists no fixed release for a 19.1 branch, so we say: if you run 19.1.x, move to a fixed branch rather than waiting. Three other fixes stand out: CVE-2026-16301 (high, 8.5), a Developer-role user starting pipelines on protected branches; CVE-2026-14814 (high, 8.2), a cache-poisoning flaw in repository file access that can expose protected CI/CD variables, affecting all versions; and CVE-2026-92883 (high, 8.7), cross-site scripting through syntax highlighting. Three medium flaws let unauthenticated visitors read confidential content through GraphQL. One figure we are not quoting as confirmed: the CVSS vector and CWE for CVE-2026-97229 from its CVE record, which we have not seen. Neither the NVD nor the CISA catalog (version 2026.10.08) listed the flaw when we checked, and neither GitLab nor CERT-EU states exploitation.

So what

An unauthenticated path to code execution on the server that holds source code, CI/CD variables and runner tokens is as high-consequence as this product gets, and a 10.0 on a self-hosted collaboration server is the kind of score that draws scanners. We found no report of exploitation, so the conservative reading is "patch this week, internet-facing first", with the variable-exposure flaws as the reason to also rotate secrets if an instance was exposed and behind. How an unauthenticated visitor reaches a CI/CD configuration compiler is not explained in the sources we read, which is a reason to patch rather than to reason about reachability.

Now what — P (Preparation); analysis

• Configuration. Upgrade self-managed instances to 19.4.2, 19.3.4 or 19.2.8. Until then, put the instance behind a VPN or an allow-list if it does not need to be public, and restrict who can reach the CI/CD configuration and lint endpoints.
• Blast radius. Treat GitLab as a secrets store: mask CI/CD variables, move high-value secrets to an external secrets manager, and protect the variables that production pipelines use. If an instance was internet-facing and behind, rotate runner registration tokens and protected variables once patched.
• Detection with a defined response. Run the version hunt below, then review audit events for runner, deploy-key and variable changes. Defined response: a build below the fixed release is an update ticket today. An unexplained process, outbound connection or runner or variable change on an unpatched instance is a suspected compromise: isolate the host, preserve it, rotate everything the instance holds and review the repositories and pipelines it serves.
• Communication. If an MSP or a platform team runs GitLab for you, ask in writing which version each instance runs and whether it is reachable from the internet.

Hunt pack — run it, then act on what it says

The fixed versions are GitLab's; the checks are our analysis. The bash script was run against synthetic inputs (vulnerable and fixed builds in each branch, a 19.1 build, a near-miss 19.4.20 that correctly does not flag, text with no 19.x version, and an empty input); the SPL, KQL and osquery were reviewed, not executed. We are not offering Sigma, Suricata or YARA: no source published a request, process or file artifact for exploitation, so the pack finds exposure, not compromise. Point the script at an inventory export or at the output of gitlab-rake gitlab:env:info. Adjust field and table names to your logging.

#!/usr/bin/env bash
# Usage: ./gitlab-hunt.sh FILE...   (text containing GitLab versions: inventory, "gitlab-rake gitlab:env:info", package list; plain or .gz) - read-only
# Flags 19.1.x through 19.4.x below the fixed release for CVE-2026-97229 (19.2.8, 19.3.4, 19.4.2); 19.1.x has no listed fix branch.
# Exit 0 = none flagged, 1 = at least one flagged, 3 = no 19.x version found (NOT a clean result)
set -uo pipefail
[ $# -ge 1 ] || { echo "usage: $0 FILE..." >&2; exit 2; }
zcat -f -- "$@" 2>/dev/null | python3 -c '
import sys, re
fixed = {2: 8, 3: 4, 4: 2}
n = found = low = 0
for line in sys.stdin:
    n += 1
    for m in re.finditer(r"(?<![0-9.])(19)\.(\d+)\.(\d+)(?![0-9])(?!\.[0-9])", line):
        found += 1
        minor, patch = int(m.group(2)), int(m.group(3))
        why = None
        if minor == 1: why = "19.1.x (in range, no listed fix branch: move to 19.2.8+)"
        elif minor in fixed and patch < fixed[minor]: why = "below 19.%d.%d" % (minor, fixed[minor])
        if why: low += 1; print("FLAGGED |", m.group(0), "|", why, "|", line.rstrip()[:160])
print(f"lines={n} versions_found={found} flagged={low}", file=sys.stderr)
sys.exit(3 if found == 0 else (1 if low else 0))'

index=* sourcetype=*inventory* (gitlab-ee OR gitlab-ce OR "GitLab") earliest=-7d
| rex field=_raw "(?<ver>19\.(?:1|2|3|4)\.\d+)"
| where isnotnull(ver)
| eval p=split(ver,"."), minor=tonumber(mvindex(p,1)), patch=tonumber(mvindex(p,2))
| where minor=1 OR (minor=2 AND patch<8) OR (minor=3 AND patch<4) OR (minor=4 AND patch<2)
| stats latest(_time) AS seen BY host, ver

DeviceTvmSoftwareInventory
| where SoftwareName has "gitlab"
| where SoftwareVersion startswith "19."
| extend p = split(SoftwareVersion, ".")
| extend minor = toint(p[1]), patch = toint(extract(@"^(\d+)", 1, tostring(p[2])))
| where minor == 1 or (minor == 2 and patch < 8) or (minor == 3 and patch < 4) or (minor == 4 and patch < 2)
| project DeviceName, SoftwareName, SoftwareVersion

SELECT name, version FROM deb_packages WHERE name IN ('gitlab-ce','gitlab-ee')
UNION ALL
SELECT name, version FROM rpm_packages WHERE name IN ('gitlab-ce','gitlab-ee');

5. HPE ClearPass Policy Manager: ten critical flaws, no fixed version read, and a management interface to restrict

Indicators

What

Per CSA's alert AL-2026-139 (12 October), the ten flaws are: CVE-2026-79798 (9.9, SQL injection in the web management interface, authenticated and low-privileged); CVE-2026-76750 (9.8, insecure deserialization in the web interface, unauthenticated); CVE-2026-76751 (9.8, missing integrity verification in the OnGuard agent, unauthenticated, code execution on the endpoint with the agent's privileges); CVE-2026-76752 (9.8, authentication bypass in the web management and API interfaces giving administrative access); CVE-2026-76753 (9.8, format-string flaw in a service interface); CVE-2026-76754 (9.8, SQL injection, unauthenticated); CVE-2026-79796 (9.8, authentication bypass); CVE-2026-79801 (9.8, missing integrity verification in the client agent); CVE-2026-79805 (9.8 as CSA lists it, path traversal described as authenticated); and CVE-2026-79794 (9.1, SQL injection, authenticated). We read the CVE record for CVE-2026-76752 (published 6 October): CVSS 3.1 9.8, affected 6.14.0 and earlier and 6.11.0 through 6.11.15, CISA's assessment lists exploitation as none, automatable as yes and technical impact as total. The Canadian Centre's alert AV26-1011 (7 October) lists the same ClearPass ranges and an additional HPE AOS-Switch advisory, HPESBNW05156, for AOS-Switch 16.11.0031 and earlier, which we did not read. Fixed versions: neither CSA nor the Canadian Centre names them; HPE's bulletin would, and its support site was not reachable from our environment, so we do not quote a fixed build. None of the ten is in CISA's catalog (version 2026.10.08).

So what

ClearPass decides which devices and people are allowed onto the network, so an administrative takeover is a step toward every switch and wireless controller that trusts it. Seven unauthenticated critical flaws in one alert, and a CISA assessment of at least one of them as automatable, is the pattern that tends to be turned into scanners once someone diffs the patch. We found no exploitation report; the conservative reading is "patch soon and shrink reachability now", because shrinking reachability needs no fixed version.

Now what — P (Preparation); analysis

• Configuration. Restrict ClearPass's administrative web interface and API to a management network or administrator workstations, and confirm that guest and captive-portal services, which have to be reachable, are separated from the administrative ones. Read HPE's bulletin HPESBNW05158 for the fixed builds and apply them; an offline cluster upgrade needs a maintenance window, so schedule it now.
• Blast radius. Review which accounts hold ClearPass administrative rights and remove the unneeded ones; require MFA for administrators where your configuration supports it; keep the shared secrets that network devices use with ClearPass in a record you can rotate, and be ready to rotate them if a server is ever found compromised.
• Detection with a defined response. Run the version check below and review ClearPass's audit log for administrator activity. Defined response: a version in the listed range is an update ticket this week and a reachability fix today. An administrator sign-in from an unexpected address, or a policy or role change nobody made, is a suspected compromise: isolate the management interface, preserve the audit log, rotate administrator credentials and device shared secrets, and review recent policy changes.
• Communication. If an MSP, a network integrator or a managed-NAC provider runs ClearPass, ask in writing which build each server runs and whether its management interface is reachable from outside the management network.

Hunt pack — run it, then act on what it says

The affected ranges are those in the CVE record and the alerts cited above; the checks are our analysis. The bash script was run against synthetic inputs (versions inside and outside each range, a version inside a different product's line that correctly does not flag, text with no ClearPass version, and an empty input); the SPL and PowerShell were reviewed, not executed. We are not offering Sigma, KQL, osquery, Suricata or YARA: ClearPass is an appliance without a standard agent or inventory table, no source published an exploit request, process or file artifact, and a rule written from a guess would be counted as a control it is not. The pack finds exposure, not compromise. Point it at a configuration-database export or at the version shown in each server's administration page; column names in the PowerShell example are placeholders for your inventory's.

#!/usr/bin/env bash
# Usage: ./clearpass-hunt.sh FILE...   (text containing ClearPass Policy Manager versions: CMDB export, admin UI copy; plain or .gz) - read-only
# Flags versions in the range the CVE records list: 6.11.0-6.11.15 and anything <= 6.14.0. Fixed versions are in HPE bulletin HPESBNW05158: confirm there.
# Exit 0 = none flagged, 1 = at least one flagged, 3 = no 6.x version found (NOT a clean result)
set -uo pipefail
[ $# -ge 1 ] || { echo "usage: $0 FILE..." >&2; exit 2; }
zcat -f -- "$@" 2>/dev/null | python3 -c '
import sys, re
n = found = low = 0
for line in sys.stdin:
    n += 1
    if not re.search(r"clearpass|cppm", line, re.I): continue
    for m in re.finditer(r"(?<![0-9.])(6)\.(\d+)\.(\d+)(?![0-9])(?!\.[0-9])", line):
        found += 1
        minor, patch = int(m.group(2)), int(m.group(3))
        if minor == 11: bad = patch <= 15
        else: bad = (minor, patch) <= (14, 0)
        if bad: low += 1; print("IN-LISTED-RANGE |", m.group(0), "|", line.rstrip()[:160])
print(f"lines={n} versions_found={found} flagged={low}", file=sys.stderr)
sys.exit(3 if found == 0 else (1 if low else 0))'

index=* sourcetype=*inventory* (ClearPass OR CPPM) earliest=-7d
| rex field=_raw "(?<ver>6\.\d+\.\d+)"
| where isnotnull(ver)
| eval p=split(ver,"."), minor=tonumber(mvindex(p,1)), patch=tonumber(mvindex(p,2))
| where (minor=11 AND patch<=15) OR (minor<>11 AND (minor<14 OR (minor=14 AND patch=0)))
| stats latest(_time) AS seen BY host, ver

# Usage: .\clearpass-inventory.ps1 -Path assets.csv [-ProductColumn Product] [-VersionColumn Version]
# Exit 0 = none flagged, 1 = flagged, 3 = no ClearPass rows found (not a clean result). Read-only.
param([Parameter(Mandatory)][string]$Path, [string]$ProductColumn = 'Product', [string]$VersionColumn = 'Version')
$rows = @(Import-Csv -LiteralPath $Path | Where-Object { $_.$ProductColumn -match 'ClearPass|CPPM' })
if ($rows.Count -eq 0) { "clearpass_rows=0 (not a clean result)"; exit 3 }
$flagged = 0
foreach ($r in $rows) {
  if ($r.$VersionColumn -match '^6\.(\d+)\.(\d+)') {
    $minor = [int]$Matches[1]; $patch = [int]$Matches[2]
    $bad = if ($minor -eq 11) { $patch -le 15 } else { ($minor -lt 14) -or ($minor -eq 14 -and $patch -eq 0) }
    if ($bad) { $flagged++; "IN-LISTED-RANGE | $($r.$ProductColumn) | $($r.$VersionColumn)" }
  }
}
"clearpass_rows=$($rows.Count) flagged=$flagged"
if ($flagged -gt 0) { exit 1 } else { exit 0 }

Sector signal — only what a source actually said

No source in this window attributed any of the five items to a sector; that is an absence of sector-attributable reporting, not an absence of risk.

How this brief is put together

Facts are reported as their named source published them: the GlobalProtect flaw from Palo Alto's advisory, the CVE record, Rapid7 and Unit 42, with ReliaQuest's actor attribution as carried by Cyber Security News and GBHackers because its own post could not be read by our tools; the Bricksforge flaw from Patchstack, the vendor's changelog and the CVE record; the Power BI campaign from Huntress; the GitLab flaws from GitLab's patch-release page and CERT-EU; the ClearPass flaws from Singapore's CSA alert, the Canadian Centre for Cyber Security and the CVE record; and catalog status from CISA's own published data. Where sources differ, as on Bricksforge's fixed version and score, we say so in the item. IoCs appear only as a named source published them and are defanged; IoAs are cited or marked ours. The hunt packs are our analysis, and each says what was tested and what was only reviewed. PIVCCERL™ is Threat Vector Management's incident lifecycle — Preparation, Identification, Validation, Containment, Communication, Eradication, Recovery, Lessons Learned; an unaffected organization is in Preparation, and a second stage appears where a hunt is warranted. ATT&CK: no source in this window published technique mappings. This brief publishes when something warrants it, not on a schedule.

Threat Vector Management helps organizations and the MDR and SOC teams that defend them turn briefs like this into action — running a look-back hunt across the logs you already keep, and deciding what a clean result does and does not let you close. Start a conversation →

More editions: Threat Brief archive.

Threat Vector Management is not affiliated with any company operating under the name “ThreatVector.”

Sources

1. Palo Alto Networks — advisory CVE-2026-0257, PAN-OS GlobalProtect Authentication Bypass, published 13 May 2026
2. CVE record CVE-2026-0257, published 13 May 2026
3. Rapid7 — observed exploitation of PAN-OS GlobalProtect authentication bypass CVE-2026-0257, May 2026, IoCs updated 2–3 June
4. Palo Alto Unit 42 — Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257, 9 June 2026
5. Cyber Security News — Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access, 11 Oct 2026, citing ReliaQuest
6. GBHackers — Ransomware Hackers Exploit Palo Alto Networks GlobalProtect VPN Authentication Bypass Vulnerability, 12 Oct 2026, citing ReliaQuest
7. The Hacker News — PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation, 30 May 2026
8. Patchstack — Critical unauthenticated arbitrary file upload vulnerability exploited in Bricksforge plugin, 8 Oct 2026
9. CVE record CVE-2026-85097, published 8 Oct 2026
10. Bricksforge — version changelog
11. The Hacker News — Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE, 12 Oct 2026
12. Huntress — Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs, 7 Oct 2026
13. GitLab — Critical patch release 19.4.2, 19.3.4, 19.2.8, 8 Oct 2026
14. CERT-EU — Security Advisory 2026-016, Critical Vulnerability in GitLab CE and EE, 12 Oct 2026
15. Cyber Security Agency of Singapore — alert AL-2026-139, HPE Networking ClearPass Policy Manager, 12 Oct 2026
16. CVE record CVE-2026-76752, published 6 Oct 2026
17. Canadian Centre for Cyber Security — HPE security advisory AV26-1011, 7 Oct 2026
18. CISA — Known Exploited Vulnerabilities catalog data, catalog version 2026.10.08

Provenance: compiled 12 October 2026 by Threat Vector Management from a sweep of vendor, government and researcher sources, with research and fact-checking support from Claude (Anthropic). Every CVE identifier, version string, score, date and indicator was checked against its cited primary record or researcher publication on the day of publication, except where an item states that a primary page could not be read; the hunt logic is our analysis of those records.