THREATSDAY this week showcases a broad mix of exploits, from widely exploited remote code execution chains to novel attacker use of DNS and AI-enabled tooling. The headline concern is active exploitation of PAN-OS GlobalProtect/Prisma Access via CVE-2026-0257, which attackers are already leveraging to gain VPN access and move laterally before weaponising networks.
ReliaQuest warns that remediation alone may not remove access established prior to patching, and recommends immediate patching, disabling unnecessary authentication override cookies, terminating active GlobalProtect sessions after patching, and monitoring for unusual connections (including hostnames like “kali”).
In parallel, a DNS-driven wallet theft kit branded as Noir uses DNS TXT records to steer victims to attacker-hosted backends via public DoH, enabling targeted wallet theft without seeds or keys and relying on AI-assisted content tailoring at the backend.
The bulletin also flags other high-severity issues across platforms and supply chains. Notable CVEs include NVIDIA’s Linux GPU driver flaw CVE-2026-47595 (Bad UVM) enabling root on affected systems and potential container escapes; SiteGuard Server Edition CVE-2026-106931 with active exploitation risk; Samsung QA-Board flaw CVE-2026-110392 allowing unauthenticated RCE; and Harbor SSRF flaw GHSA-2phj-cp9f-qq6w with CVSS 8.5 allowing cloud-credential theft.
The compilation spans broader gadgetry from WordPress backdoors and AI model protection to remote code execution in enterprise apps, with patches in NSD (CVE-2026-101341, 101339, 101338, 101337), Xen race condition CVE-2026-79610, and other notable fixes. Practically, the guidance centres on applying patches where available, validating access controls, and heightened monitoring for unusual authentication or data access patterns.