🚨 ACTIVE EXPLOITATION
- Ransomware gangs exploit GlobalProtect MFA bypass (CVE-2026-0257), steal credentials from VMware disks Ransomware operators are exploiting a Palo Alto GlobalProtect authentication bypass to bypass MFA and steal credentials, including from a domain controller's virtual disk.
- Affects GlobalProtect portals and gateways in certain PAN-OS and Prisma Access deployments; requires authentication override cookies enabled with a vulnerable certificate setup; Panorama and Cloud NGFW not affected; CVSS 7.8 (High).
- Exploitation linked to Qilin (Spikey Scorpius) and Inc Ransom (Tarnished Scorpius), with separate reporting tying it to Settra ransomware; sectors hit since early June include healthcare, education, finance, manufacturing, government, and energy.
- Vulnerable devices decrypt override cookies without verifying a trusted creator; if the cookie certificate is reused on a public service, attackers can forge a cookie and connect without login or MFA.
- Post-access: RMM tools for recon, lateral movement via RDP and SMB; in one case attackers moved to vCenter, disabled execInstalledOnly on ESXi, and extracted credentials offline from a domain controller VMDK, evading EDR inside the VM.
- Reported IOCs: IPs 104.207.144[.]154 and 146.19.216[.]125, device names GP-CLIENT and DESKTOP-GP01, host IDs aa:bb:cc:dd:ee:ff and 00:11:22:33:44:55; attackers also chained Veeam CVE-2023-27532. 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
💥 BREACHES & INCIDENTS
- Paradigm Healthcare breach affects 970,000 Medi-Cal members Paradigm Healthcare Services disclosed a data breach affecting 970,403 Medi-Cal members.
- Applies to Medi-Cal members whose billing is processed by San Francisco-based Paradigm Healthcare Services under a data use agreement with California DHCS
- Files containing names, dates of birth, gender, and Medi-Cal member ID numbers may have been accessed between October 8 and October 15, 2025
- Paradigm detected unauthorized access to its local network on October 13, 2025; the Student Health Network (SHN) billing platform was not impacted
- Notification letters dated September 14, 2026 went out roughly 11 months after detection; no threat actor or access method has been disclosed
- Paradigm took systems offline, notified law enforcement, and engaged outside incident response experts; no fraud or identity theft has been confirmed 📄 Source: paradigm-healthcare.com · 📎 Coverage: securityweek.com · 👁 via SecurityWeek
🕵️ RESEARCH & DEEP DIVES
Leaked Cellebrite doc suggests iPhone Bluetooth zero-day behind new 'Advanced Unlocks' product A leaked confidential Cellebrite document describes a new 'Advanced Unlocks' capability that may rely on an undisclosed iPhone Bluetooth zero-day.
- Applies to iPhone 11-16 running iOS 26-26.4+; iPhone 17 generation and Air are conspicuously unsupported.
- Cellebrite's Advanced Unlocks (AU), a 2026 product, is described as a 'next-generation AFU vector' resilient to Apple OS changes, working even with Stolen Device Protection enabled.
- AU is enabled by a dedicated appliance with a stated range of about 8 meters, suggesting a proximity-based radio capability.
- Analysis points to a use-after-free in bluetoothd's L2CAP channel manager, reachable pre-pairing over the air with no user interaction, patched quietly in iOS 26.5; iOS 26.7/27 separately fixed Bluetooth RCE CVE-2026-65414 in the same code path.
- Apple's Memory Integrity Enforcement (MIE), present on all iPhone 17 models, is the likeliest explanation for the model cutoff, blocking the theorized exploit chain. 📎 Coverage: schneier.com · 👁 via Schneier on Security
AI-assisted TAG-217 attacks hit South Korean banks, exposed tools reveal wider operation Recorded Future tracked TAG-217, an AI-assisted actor whose exposed infrastructure revealed tooling behind attacks on South Korean banks.
- Breaches exposed personal data of at least 68,000 people across at least seven South Korean financial institutions, including customer records and outsourced developer details.
- Recorded Future's Insikt Group tracked the actor as TAG-217, tracing preparations back to August 2026 and assessing a financially motivated, likely Chinese-speaking operator.
- The campaign used the Chinese-language open-source pentesting framework ARTEX, plus exposed Claude Code sessions, AI memory files, and links to DeepSeek, Grok, and Zhipu AI.
- Exposed files showed tools targeting cryptocurrency mining (YiiMP), stealing wallet configs and keys, exploiting Linux weaknesses, and testing iPhone and Android exploits; traffic was routed via residential proxy networks.
- No malware family named; no hashes or IPs publicly disclosed. 📄 Source: recordedfuture.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)