Search
Find merged stories by title or summary.
Major Cyber Vendors Turn to New UK Testing Program as MITRE Evaluations Face Changes
A group of cyber threat detection providers, including CrowdStrike, Palo Alto Networks and Sophos, have joined SE Labs’ PIVOT program
Cybersecurity M&A Roundup: 33 Deals Announced in August 2026
Significant cybersecurity M&A deals announced by Brinqa, Cribl, Echo, Fortinet, Kiteworks, Palo Alto Networks, and Visa. The post Cybersecurity M&A Roundup: 33 Deals Announced in August 2026 appeared first on SecurityWeek .
Cylake Raises $245 Million Ahead of Cybersecurity Platform Beta
The startup founded by Palo Alto Networks’ Nir Zuk has raised $290 million to build an AI-native security platform for highly regulated organizations that cannot rely on the public cloud. The post Cylake Raises $245 Million Ahead of Cybersecurity Platform Beta appeared first on SecurityWeek .
Top 10 Best Managed XDR Services in 2026
Managed XDR is MDR with a wider aperture: analysts monitoring correlated telemetry from endpoints, network, email, identity, and cloud rather than endpoints alone. Deploying modern Extended Detection and Response (XDR) solutions helps bridge coverage gaps across hybrid environments, while dedicated Managed Detection and Response (MDR) services provide continuous human oversight. Palo Alto’s Unit 42 service scores highest on the combination of platform depth and incident response pedigree, Secureworks Taegis leads on detection research, and Trend Micro offers the broadest native telemetry. Here are the ten best, scored plus an honest answer to whether MXDR is a real category or a rebranding of MDR.
Top 10 Best Extended Detection & Response (XDR) Platforms in 2026
Palo Alto Cortex XDR scores highest in our 2026 evaluation, with CrowdStrike close behind on detection engineering and Microsoft Defender XDR leading on economics for organizations already holding E5. Modern Extended Detection and Response (XDR) solutions correlates signals from endpoints, network, email, identity, and cloud into single investigable incidents reducing alert volume rather than adding another console. Here are the ten best, scored, and the one architectural question that should decide your shortlist. The 2026 XDR Scorecard Rank Platform Data coverage (25%) Correlation quality (25%) Response automation (20%) Openness (15%) Operability (15%) Total 1 Palo Alto Cortex XDR 10 10 9 6 7 8. 8 2 CrowdStrike 9 9 9 7 8 8. 5 3 Microsoft Defender XDR 9 9 8 5 8 8. 2 4 SentinelOne Singularity 8 8 10 8 8 8. 3 5 Trend Micro Vision One 9 8 7 7 7 7. 9 6 Trellix 8 8 7 7 6 7.
🏴☠️ Dark project has just published a new victim : MEI Architects
About MEI Architects MEI Architects is a firm based in San Francisco that specializes in commercial, residential, and public architecture. They provide elegant and pragmatic solutions tailored for government, nonprofit, and private clients. Their portfolio includes notable projects such as the Portsmouth Square Improvement Project and the VA Palo Alto Polytrauma Aquatic Therapy Center. The firm is committed to community-minded design and successful partnerships. As a result of the attack, 340 GB of data (approximately 130,000 files) was stolen: including Social Security numbers, passports, green cards, invoices, HR documents, and a vast number of architectural drawings—including those from past and current projects, as well as those currently under construction.
8 Managed Firewall Services: Who to Watch in 2026
The verdict: if you want the deepest expertise on the platform you own, buy the managed service from the vendor who built it Palo Alto or Fortinet. If you want independent operators who’ll manage whatever you already have, Secureworks and the global system integrators are the strongest options. If you’d rather stop owning firewalls altogether, Cato Networks is the cleanest path. Below, eight providers matched to the buyer each actually fits and two ownership changes that should shape any multi-year contract. A managed firewall service transfers day-to-day firewall operation policy changes, patching, monitoring, tuning, and incident response to a provider with a 24/7 security operations centre. Check These Two Things Before You Sign Anything Managed security contracts run three to five years.
8 Network Sandboxing Solutions: Our Top Picks by Use Case (2026)
Bottom line up front: if you already own a Check Point, Palo Alto, or Fortinet firewall, your sandbox decision is largely made buy the subscription and get verdicts pushed to enforcement automatically. If you need to understand malware rather than merely block it, Recorded Future’s Triage or a self-hosted analysis platform serves you far better. And if you’re considering the open-source route, read the Cuckoo section carefully before you commit engineering time. Network sandboxing detonates unknown files and URLs in an isolated environment and watches what they do catching malware that has never been seen before and therefore has no signature to match against, strengthening overall enterprise cybersecurity infrastructure . Stage 1 — Work Out Which Problem You’re Solving These are two different products that get sold as one category.
Top 10 Best Managed Firewall Services in 2026
Palo Alto Networks scores highest in our 2026 evaluation of managed firewall service , with Fortinet close behind on breadth and value and Cato Networks leading on cloud-native delivery. A managed firewall service transfers day-to-day firewall operation policy changes, patching, monitoring, tuning, and incident response to a provider with a 24/7 SOC, so your team stops doing 2 a. m. rule changes. Here are the ten best, scored, with the ownership changes you must factor into a multi-year contract. The 2026 Managed Firewall Scorecard Rank Provider SOC & response (30%) Platform coverage (25%) Service model (20%) Global reach (15%) Value (10%) Total 1 Palo Alto Networks 9 8 9 9 7 8. 6 2 Fortinet 8 9 8 9 9 8. 5 3 Cato Networks 8 8 9 9 8 8. 4 4 Secureworks 10 8 8 8 7 8. 6 5 LevelBlue (AT&T) 9 9 8 9 7 8. 6 6 NTT Data 8 9 8 10 7 8. 4 7 Orange Cyberdefense 9 8 8 9 7 8.
Top 10 Best Network Security Policy Management Tools in 2026
Tufin scores highest in our 2026 evaluation of network security policy management (NSPM) tools, with AlgoSec close behind on application-centric automation and FireMon leading on real-time change detection. NSPM tools discover, analyse, and automate firewall and security policy across multi-vendor estates cleaning up rule bloat, proving compliance, and pushing changes without breaking production. Here are the ten best, scored, plus one important market change you need to know before shortlisting. The 2026 NSPM Scorecard Rank Solution Multi-vendor coverage (25%) Automation (25%) Risk & compliance (20%) Visibility/modelling (20%) Usability (10%) Total 1 Tufin 10 9 9 8 8 9. 0 2 AlgoSec 9 10 9 8 8 9. 0 3 FireMon 9 8 9 9 8 8. 7 4 Forward Networks 8 7 8 10 8 8. 2 5 RedSeal 8 6 9 10 7 8. 1 6 Palo Alto Networks 6 9 8 8 9 7. 8 7 Cisco 6 8 8 8 7 7. 4 8 ManageEngine 7 6 7 6 9 6.
AI Agents Breach Company Network in Under 10 Hours and Steal Root Credentials
A threat actor used frontier AI models and attack-specific agentic frameworks to breach an enterprise environment, harvest root credentials, and hijack cloud AI infrastructure in under 10 hours. Documented by Palo Alto Networks Unit 42, the incident demonstrates how AI-assisted automation can compress an intrusion that might normally require multiple human red-team operators and roughly two weeks of work into a single machine-speed campaign. The attacker reportedly used an automated loop in which specialized AI agents monitored tool output, evaluated options, executed actions, and replanned their next steps. AI Agents Breach Enterprise Network Rather than relying on a previously unknown vulnerability or exceptionally novel tradecraft, the actor used existing attack methods at a far higher operational tempo.
Agentic Ransomware Took Down Enterprise in Ten Hours: AI Left 80-Page Audit
Roger Satterfield reports: An attacker handed an unknown corporate victim a comprehensive, 80-page security audit on Wednesday — not as a service, but as a postscript to the ransomware attack that had just consumed the victim’s enterprise. According to Palo Alto Networks’ threat intelligence unit Unit 42, whose researchers documented the September 2 incident, the… Source https://databreaches.net/2026/09/03/agentic-ransomware-took-down-enterprise-in-ten-hours-ai-left-80-page-audit/1post-1participantReadfulltopic
AI agents help compress ransomware intrusion to under 10 hours, raising stakes for CISOs
A ransomware attacker used AI agents to move through an enterprise network in less than 10 hours, according to Palo Alto Networks researchers, who estimated that similar work could have taken human operators about two weeks. The incident involved more than 50 techniques mapped to the MITRE ATT&CK framework, according to the company’s Unit 42 threat research team . The techniques themselves were largely familiar. The notable difference, according to Unit 42, was the use of AI agents that could interpret the results of their actions and adapt subsequent steps during the intrusion. Unit 42 said it observed several indicators consistent with AI use during its investigation. The threat actor also told researchers during negotiations that frontier AI models and attack-specific agentic frameworks had been used.
Palo Alto Networks Acquires Console to Bring Autonomous AI Agents to Security Operations
Palo Alto Networks has acquired Console, an AI-native platform that will strengthen Cortex by enabling AI-driven security workflows to investigate, prioritize, and remediate threats at machine speed. The acquisition comes as security teams face rising alert volumes, increasingly automated attacks, and pressure to reduce the time required to detect and contain threats. Palo Alto Networks said Console’s technology will help organizations use natural-language instructions to create AI agents that can analyze enterprise data, coordinate tasks, and take action across security and IT environments. The Console is built on the idea that users should be able to define an operational objective. At the same time, AI software handles the technical steps required to complete it.
Palo Alto Networks Acquires AI Agent Platform Console
The cybersecurity giant announced the acquisition alongside quarterly results showing a 34% increase in revenue and strong growth in next-generation security ARR. The post Palo Alto Networks Acquires AI Agent Platform Console appeared first on SecurityWeek .
Vishing campaign abuses Microsoft Teams to give attackers a foothold in company networks
A coordinated voice-phishing (vishing) campaign, named Spring Ring, used fake IT support accounts on Microsoft Teams to trick employees into installing malware or granting remote access to their computers, according to Unit 42, Palo Alto Networks’ threat intelligence team. The campaign ran between January and April 2026 and reached more than 150 employees at more than 10 companies in different industries. The attackers registered external Microsoft Teams tenants with names built to resemble internal IT … More → The post Vishing campaign abuses Microsoft Teams to give attackers a foothold in company networks appeared first on Help Net Security .
Hackers Weaponize Microsoft Teams Help Desk Calls for Malware and Network Lateral Movement
Attackers are turning Microsoft Teams help desk calls into an entry point for malware and network compromise. A campaign tracked as Spring Ring used external accounts that resembled internal IT support to chat with employees, then call them and press for remote access or software execution. The activity ran from January through April 2026 and approached more than 150 employees at at least 10 organizations. Its danger lies in the human element: a familiar sounding technician and a live conversation can make an unexpected request feel urgent and legitimate. Analysts at Unit 42 identified the operation after detecting suspicious chat creation across multiple Microsoft 365 tenants, uncovering 26 distinct attacker identities. Palo Alto Networks said in a report shared with Cyber Security News (CSN) that the group did not exploit a flaw in Teams.
Reverse Engineering the Auto-Color Linux Backdoor
Static and dynamic analysis of Auto-Color’s execution flow, C2 communication, and LD_PRELOAD rootkit. Auto-Color in a Nutshell Auto-Color is an emerging Linux backdoor first documented by Palo Alto Networks Unit 42 in February 2025. The earliest known samples were collected between November and December 2024, with universities and government offices in North America and Asia being the main observed targets. The family was named after the filename used by the payload after installation. Its initial delivery method is still unknown, but once executed it can provide an attacker with remote access while using several techniques to hide its activity. Technical Summary The sample analyzed in this report has two noticeably different execution paths. Without root privileges, it moves into the background, stores its state under /tmp/cross, and repeatedly tries to contact 146. 70. 41.
Frontier AI tipping the scales toward cyber adversaries
Researchers at Palo Alto Networks’ Unit 42 warn that threat actors are already using AI to accelerate cyberattacks beyond the abilities of modern defenses.
Learn Palo Alto Networks cybersecurity with this $20 training - TechRepublic
Learn Palo Alto Networks cybersecurity with this $20 training TechRepublic
Will Massive Security Glossary From Microsoft, Google, CrowdStrike, Palo Alto Improve Collaboration? - TechRepublic
Will Massive Security Glossary From Microsoft, Google, CrowdStrike, Palo Alto Improve Collaboration? TechRepublic
Unit 42 warns AI has shifted balance of power from defenders to attackers
Unit 42’s top brass has seen enough from internal frontier AI model testing and malicious in-the-wild use of commercially available AI tools to be genuinely concerned. “I can tell you without exaggeration that we believe that this is a generational shift in cybersecurity,” Sam Rubin, senior vice president of Palo Alto Networks’ threat intelligence arm, said in a media briefing Wednesday. A period of relative balance between security and exposure has been broken by frontier AI model capabilities that could allow attackers to find and exploit network weaknesses with speed, Rubin said. Unit 42 warned that capabilities demonstrated by readily available agentic AI models, and those unlocked by frontier AI models that remain gated for defense, have shifted the balance of power from defenders to attackers.
AI Speeds Up Malware Development, Not Its Success Rate: Analysis
Palo Alto Networks Unit 42 analyzed 405 AI-linked malware samples and found only 12 reached production endpoints. The post AI Speeds Up Malware Development, Not Its Success Rate: Analysis appeared first on SecurityWeek .
Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter
A joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs reveals that both state-sponsored actors and cybercriminals independently converge on the same edge infrastructure. Special thanks to SentinelOne® Incident Readiness & Response for their contributions to this publication. It is the shared attack surface where state-sponsored threat actors and financially motivated criminal groups independently converge — not the province of a single adversary category, and not exclusively a nation-state problem, despite two years of headlines about China-nexus actors targeting Ivanti, Fortinet, and Palo Alto Networks. The data here tells a different and much broader story. One focused on vendors vs CVEs.
Best Business VPN Solutions: Our Top Picks by Use Case (2026)
A business VPN gives remote staff encrypted access to internal systems but “which VPN is best” is the wrong question in 2026. The right question is whether you need a traditional VPN at all, or whether a zero-trust access service would serve you better We scored eight options across both camps and matched each to the buyer it actually fits, from a ten-person startup to a field workforce on unreliable mobile connections. Best Business VPN by Use Case — At a Glance Your situation Our pick Score Existing Fortinet firewalls Fortinet 8. 5 Large enterprise, Cisco estate Cisco Secure Client (AnyConnect) 8. 2 Field workforce on poor mobile coverage Absolute (NetMotion) 8. 4 Small team wanting the simplest setup Tailscale 8. 6 SMB wanting managed cloud VPN NordLayer 8. 0 Palo Alto enterprise estate Palo Alto GlobalProtect 8. 1 Self-hosted and full control OpenVPN Access Server 7.
Chinese Hacker Uses DeepSeek AI to Automate Vulnerability Exploitation
A Chinese-speaking threat actor has been observed using DeepSeek AI as an autonomous offensive operator to identify exposed infrastructure, research vulnerabilities, acquire public proof-of-concept exploits, and launch attacks with minimal human intervention. Palo Alto Networks Unit 42 tracked the activity to an actor known as knaithe and KnYuan, describing the campaign as an early but functional example of end-to-end AI-assisted cyberattack automation. While the autonomous operations produced limited confirmed impact, the researchers warned that the campaign demonstrates how large language models can accelerate vulnerability research, target prioritization, and exploitation workflows.
Top 10 Best Network Sandboxing Solutions in 2026
Network sandboxing detonates unknown files and URLs in an isolated environment to see what they actually do catching malware that has never been seen before and therefore has no signature. Palo Alto WildFire leads on scale and integration, VMRay leads on evasion-resistant analysis depth, and Joe Security remains the analyst’s tool of choice for deep manual investigation. Here are the ten best sandboxing solutions and how to match analysis depth to your team.
Cyber Security Weekly Newsletter – Outlook RCE, Palo Alto, Cisco 0-day and Windows 0-Day Flaws +20 Stories
This week’s roundup covers a record-setting Microsoft Patch Tuesday, an actively exploited Cisco firewall zero-day, a Lazarus-linked Windows kernel bug, and critical flaws across TP-Link, Palo Alto Networks, Fortinet, and VMware — plus a first-of-its-kind autonomous AI agent “hack” and a DEF CON in-flight Wi-Fi scare. Ransomware & Threat Actor Campaigns Gunra Ransomware Exploits Fortinet VPN Flaws to Bypass MFA A joint FBI, CISA, NSA, and South Korean advisory has exposed the Gunra ransomware group, a Conti-derived double-extortion operation that emerged in April 2025 and has since matured into a full ransomware-as-a-service model rebranded as “Golden Community.”
AI Token Jacking Lets Hackers Steal API Keys and Rack Up Nearly $1 Million in Charges
AI credentials are drawing criminal attention. A growing form of abuse, called AI token jacking, lets intruders take API keys and consume expensive model services on someone else’s account. The result can be a sudden bill. The theft is not limited to a single break-in method. Attackers can obtain developer credentials through phishing, information-stealing malware, exposed file shares, public code repositories, or poisoned software packages. A compromised key can feed an illicit proxy service that consumes paid AI capacity. Analysts at Unit 42 identified a rising number of these cases and described losses that can become severe within minutes. Palo Alto Networks said in a report shared with Cyber Security News (CSN) that attackers have turned inadvertently exposed credentials into nearly $1 million in charges before victims detected and contained the abuse.
Cybersecurity M&A Roundup: 21 Deals Announced in July 2026
Significant cybersecurity M&A deals announced by Barracuda, CrowdStrike, Cyera, Okta, Palo Alto Networks, and Qualcomm. The post Cybersecurity M&A Roundup: 21 Deals Announced in July 2026 appeared first on SecurityWeek .
CVE-2026-0301 - PAN-OS: Information Disclosure Vulnerability in URL Filtering
CVE ID : CVE-2026-0301 Published : Aug. 13, 2026, 2:05 a. m. • 59 minutes ago Description : An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability. Severity: 1.7 • LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-0299 - GlobalProtect App: Local Privilege Escalation Vulnerabilities
CVE ID : CVE-2026-0299 Published : Aug. 13, 2026, 2:04 a. m. • 1 hour, 1 minute ago Description : Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on iOS, Android, and Chrome OS is not affected. Severity: 5.9 • MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-0298 - GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)
CVE ID : CVE-2026-0298 Published : Aug. 13, 2026, 2:02 a. m. • 1 hour, 2 minutes ago Description : An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client. The GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected. Severity: 5.2 • MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-0297 - GlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel Handshake
CVE ID : CVE-2026-0297 Published : Aug. 13, 2026, 2:01 a. m. • 1 hour, 3 minutes ago Description : A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man-in-the-middle (MitM) attacker or a rogue gateway to disrupt system processes and potentially execute arbitrary code with elevated privileges (SYSTEM privileges on Windows, and root privileges on macOS and Linux). Severity: 5.2 • MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-0296 - GlobalProtect App: Improper Certificate Validation Bypass Vulnerability
CVE ID : CVE-2026-0296 Published : Aug. 13, 2026, 1:59 a. m. • 1 hour, 5 minutes ago Description : Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) access to intercept and modify application communications. VPN tunnel traffic is not impacted. The GlobalProtect app on iOS, Android, and Chrome OS is not affected. Severity: 4.5 • MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-0295 - GlobalProtect App: Local Privilege Escalation via Race Condition on macOS
CVE ID : CVE-2026-0295 Published : Aug. 13, 2026, 1:57 a. m. • 1 hour, 7 minutes ago Description : A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root. The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected. Severity: 4.1 • MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-0294 - Prisma Access Agent: Local Privilege Escalation
CVE ID : CVE-2026-0294 Published : Aug. 13, 2026, 1:54 a. m. • 1 hour, 11 minutes ago Description : A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and macOS devices enables a local user to execute code with elevated privileges. The Prisma Access Agent on Linux, iOS, Android, and ChromeOS is not affected. Severity: 6.0 • MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-0293 - Prisma Access Agent: Anti-Tamper Protection Bypass on Windows
CVE ID : CVE-2026-0293 Published : Aug. 13, 2026, 1:51 a. m. • 1 hour, 14 minutes ago Description : A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected. Severity: 5.6 • MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Palo Alto Networks Patches 11 New Vulnerabilities Across PAN-OS, GlobalProtect, and Prisma Access
Palo Alto Networks has released its August 12, 2026 security bulletin, disclosing 11 new vulnerabilities affecting PAN-OS, the GlobalProtect App, Prisma Access Agent, and Prisma Browser, along with a monthly Chromium update rollup. The patch batch spans information disclosure, local privilege escalation, buffer overflow, certificate validation bypass, and anti-tamper bypass flaws. Severity scores range from a low 1. 1 to a moderate 7. 2 on the CVSS scale, meaning none of the newly published issues reach critical severity in this release cycle. Security teams monitoring PAN-OS vulnerabilities should evaluate endpoint exposures across enterprise environments. Palo Alto Networks Patches 11 New Vulnerabilities The most notable infrastructure entry, CVE-2026-0301, is a low-severity (CVSS 1. 7) information disclosure vulnerability in PAN-OS URL Filtering.
Record-breaking Kimwolf DDoS botnet released new, stealthier version
Palo Alto Networks’ Unit 42 has uncovered a new version of the Kimwolf Android and IoT botnet that adds stealth to its DDoS attacks and multiple backup mechanisms designed to keep infected devices connected when command-and-control (C2) servers are disrupted. The variant, dubbed Kimwolf v7, was discovered on February 3, 2026, during threat-hunting efforts that … The post Record-breaking Kimwolf DDoS botnet released new, stealthier version appeared first on CyberInsider .