Ransomware crews are using a Palo Alto firewall flaw to slip past two-step login and reach office networks. A fix has existed since May 13.
Several ransomware gangs, including Qilin and Inc, have been breaking into company networks through a flaw in Palo Alto Networks firewall software. Palo Alto's response team, Unit 42, says it has been investigating these attacks since early June. The flaw is tracked as CVE-2026-0257.
The bug sits in GlobalProtect, the part of Palo Alto's PAN-OS software that handles remote VPN access. A VPN is a private tunnel that lets staff reach the office network from elsewhere. The flaw lets attackers set up a VPN session without the usual multi-factor login, the second check such as a code on your phone.
Once inside, the criminals move from computer to computer using standard Windows tools. They install more malware to steal passwords and data, then deploy the ransomware, which locks files until a payment is made.
Palo Alto patched the flaw on May 13 but first rated it medium severity. It said it knew of attempts to exploit it but had seen no harmful use. That changed fast. By the end of May, security firm Rapid7 reported successful attacks at multiple customers, going back to at least May 17.
Unit 42 also describes a more dangerous turn. In one case, attackers jumped from the VPN gateway to the system that manages a company's virtual servers. They switched off a protection on those servers and copied login data from a stored disk image of a key server. That method gets around security software running inside the servers. In other cases, attackers paired this flaw with an older one in Veeam backup software, CVE-2023-27532.
Any organization running a vulnerable PAN-OS GlobalProtect portal or gateway. Unit 42 has seen victims in education, finance, healthcare, high tech, hospitality, manufacturing, legal and professional services, government, transportation, utilities and energy, and retail. Security firm ReliaQuest says other groups, including Settra ransomware operators, are using the bug too.
The material does not say that businesses without these firewalls are at risk from this flaw. If you do not use Palo Alto firewalls with GlobalProtect, this one is not aimed at you. If you do, patching alone may not be enough, because attacks began before many organizations updated.
The alert box above lists the steps. The short version: find out whether you use this product, update it, and have someone check whether attackers already got in. Backup and virtual server systems need attention too.
Palo Alto did not answer The Register's questions, including how many organizations have been infected. That number is unknown. Unit 42 says the attacks are continuing, so expect more victims to come to light.
If your business uses a Palo Alto firewall for remote access, confirm it was patched and have someone check for signs of a break-in.
Scammers are emailing Humboldt County well permit applicants and demanding $5,960 before a permit is issued. The county says the fee is fake.
Read more: Fake County Emails Demand $5,960 Fee for Well PermitsCallers posing as the Sheriff's Office told a Sarasota County woman she missed jury duty. She lost over $40,000, and the same scam is hitting others.
Read more: Fake jury duty calls cost one Florida woman over $40,000Europol warns that scam callers can fake the number on your screen, so the safest move is to hang up and call back using a number you found yourself.
Read more: Got a suspicious call? Hang up and look up the number yourself
