Welcome to my weekly cybersecurity roundup! Here, I share updates on the projects I’m currently working on, along with the most insightful cybersecurity videos I watched, articles I found valuable, and podcasts I tuned into this week.

Understanding the Palo Alto Networks Firewall Vulnerability (CVE-2026-0257)

To understand what happened with Palo Alto Networks firewalls last week, it helps to first understand how the cybersecurity industry tracks these kinds of flaws.

Every time a security flaw is discovered in software or hardware, it is given a unique ID called a CVE, which stands for Common Vulnerabilities and Exposures. Managed by a non-profit organization called MITRE, the CVE system acts as an international dictionary for security bugs. Giving a flaw a name like CVE-2026-0257 allows security analysts, vendors, and IT administrators around the world to quickly identify, talk about, and patch the exact same issue without any confusion.

The flaw in this specific CVE involves GlobalProtect, which is the Virtual Private Network (VPN) software that employees use to securely log into their corporate networks from home. To keep users from having to type their passwords every single time they reconnect, the firewall uses an “Authentication Override” feature. This feature hands the user’s browser an encrypted digital cookie (like a digital badge). The next time the user connects, the firewall looks at the badge, decrypts it, and lets them right in.

The security breakdown happens because of a shortcut in how some networks are set up. To secure normal web traffic, the firewall naturally has to share its public cryptographic key with the entire internet. However, if an administrator uses that exact same key to encrypt the digital login badges, a major problem arises. A clever attacker can grab that public key from the internet, reverse-engineer how the badges are made, and forge a fake digital badge. When they present this forged badge to the firewall, the system blindly trusts it, allowing the attacker to bypass the login screen entirely and gain access to the internal corporate network.

Initially, this bug was thought to be a minor issue, but it was upgraded to a high-severity threat once hackers were caught actively using it to break into companies. To fix it, cybersecurity teams have to install an urgent software patch from the vendor. If they cannot patch it right away, they have to manually change their settings to ensure the firewall uses a completely separate, secret key just for signing those login badges; keeping it hidden away from the public internet.

Projects

• TryHackMe – AI/ML Security Threats – In Progress

Articles

• PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation – Palo Alto Networks has warned that a recently disclosed medium-severity security flaw impacting PAN-OS and Prisma Access has come under active exploitation in the wild.
• Russian Spies Are Aggressively Seeking Western Technology as Sanctions Bite, Officials Say – Moscow’s agents are building fake companies, recruiting middlemen and deploying cyber spies and hackers who gather information that could be used to attack key infrastructure.
• Dutch Authorities Dismantle Botnet Linked to 17 Million Infected Devices – Dutch authorities have announced the takedown of a botnet that enslaved millions of infected devices, including computers, tablets, smartphones, and IoT devices, to carry out malicious attacks.
• As the Pentagon Pushes for Battlefield AI, Some Military Leaders Urge Caution – AI’s use in the military is part of the administration’s larger push to grow the capability it sees as a unique American advantage.
• Fake Anthropic Sites Deliver Fileless Infostealer to Claude Code Users – Fake Anthropic websites are being used to target Claude Code users with a fileless infostealer campaign that steals browser credentials and evades detection.
• Dashlane password manager users locked out by brute force attacks – Multiple Dashlane users have been locked out of their accounts following brute-force attacks that attempted logins from distant locations and unknown devices.
• Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks – A threat actor tracked as DriveSurge has been operating large-scale malware distribution campaigns using ClickFix and FakeUpdates techniques on compromised sites.
• ChatGPT blindly trusts browser content, turning the page into a payload – You and me go ChatGPhish-ing in the dark.
• People are using prompt injection to trick Meta’s AI into handing over Instagram accounts – Before Meta patched it, an exploit reportedly allowed attackers to take over accounts for months, including the Obama White House Instagram account.
• Microsoft Exchange Online outage causes email delays, failures – Microsoft is working to address a widespread service issue affecting the mail flow pipeline for Exchange Online customers across North America, Asia-Pacific (APAC), and Europe.
• Police dismantles 9 crime groups in illegal streaming crackdown – European and international law enforcement agencies have dismantled nine organized crime groups and arrested 29 suspects in a major crackdown on illegal streaming operations.
• Hackers Spied on a Stock Exchange Executive’s Outlook Mailbox for Five Months – Unknown attackers spent at least five months inside the Outlook mailbox of a senior executive at a major global stock exchange, copying the inbox out in small, repeated batches and routing it through Dropbox and OneDrive so the traffic blended into normal cloud activity.
• Over 1.4 Million Accounts Disrupted in Cybercrime Crackdown – Law enforcement and tech companies disrupted infrastructure linked to scammers operating across Southeast Asia.
• Five Eyes: Watch out for odd LinkedIn connection requests, China’s back on the hunt for state secrets – Cash-for-intel tradecraft continues to concern intelligence officials years after it was first spotted
• Over 900 US gas station tank gauge systems exposed to attacks – Over 900 automatic tank gauge (ATG) systems across the United States, used to monitor fuel and chemical storage tanks across various critical infrastructure sectors, have been found exposed online and are vulnerable to ongoing attacks.
• My SSN was exposed in a breach at Columbia—a school I have no connection with – Columbia admits last year’s data breach exposed victims beyond its students, staff.
• Uber interviewed him, hired him, shipped a MacBook. Then he vanished – Raghu Tenneti, Principal Recruiter at Uber, recounted the unusual hiring experience, where the candidate vanished before joining the company