VulnHub

Researchers from Palo Alto Networks Unit 42 have identified a new version of the Kimwolf botnet, known as Kimwolf v7, which targets Android devices and Internet of Things (IoT) devices. This upgraded botnet enhances its ability to launch distributed denial-of-service (DDoS) attacks by disguising its HTTP/2 traffic to resemble legitimate web browsing. This makes it harder for security systems to detect and mitigate the attacks. The discovery of Kimwolf v7 raises concerns for users of vulnerable Android and IoT devices, as attackers can exploit these weaknesses to disrupt services and potentially gain unauthorized access to sensitive information. Companies and users need to be vigilant and ensure their devices are secured against such threats.

Researchers at Palo Alto's Unit 42 have identified a new AI-driven cyberattack campaign attributed to a Chinese hacking group. This operation utilized a system called DeepSeek, which autonomously scanned for potential targets, selected vulnerabilities, and executed attacks with minimal human intervention. The discovery marks a significant shift in the capabilities of cybercriminals, showcasing how AI can streamline the hacking process. The implications are serious for organizations worldwide, as this technology could enable more frequent and sophisticated attacks, making it harder for security teams to defend against them. Companies need to be aware of this evolving threat and take proactive measures to protect their systems from automated attacks.

A Chinese-speaking hacker has been using a tool called DeepSeek, which operates through the open-source Hermes Agent framework, to carry out autonomous cyberattacks. According to researchers from Palo Alto Networks' Unit 42, the attacker initially sent commands via Telegram, after which the agent autonomously scanned for vulnerable internet-facing systems and exploited them using publicly available exploits. Notably, there was no further input from the hacker during the attack session. The individual behind these activities is believed to go by the aliases knaithe and KnYuan. This incident raises concerns about the increasing sophistication of cyberattacks, where attackers can automate processes to exploit vulnerabilities without continuous oversight, posing risks to various organizations and their systems.

Cybercriminals are exploiting a serious vulnerability in Palo Alto Networks' PAN-OS to gain access and deploy Qilin ransomware, also known as Agenda. This vulnerability, identified as CVE-2026-0257, has a CVSS score of 7.8 and allows attackers to bypass authentication on both the portal and gateway. Arctic Wolf Labs reported multiple incidents in June 2026 where this flaw was used to infiltrate systems. Although the vulnerability has been patched, organizations need to ensure their systems are updated to prevent potential attacks. The Qilin ransomware can lead to significant data loss and operational disruption, emphasizing the need for vigilance in cybersecurity practices.

Palo Alto Networks has issued an advisory regarding vulnerabilities in its PAN-OS software that affect the Siemens RUGGEDCOM APE1808, utilized in critical manufacturing sectors globally. The vulnerabilities include cross-site scripting, privilege escalation, and command injection, which could allow authenticated users to execute arbitrary commands or store malicious scripts. Users of the RUGGEDCOM APE1808 need to be particularly cautious, as these security flaws could lead to unauthorized access and potential exploitation of the device. Siemens recommends that affected customers consult with their support teams to obtain patches and implement security measures to protect their systems.

The Qilin ransomware group is taking advantage of a serious flaw in PAN-OS GlobalProtect, which allows attackers to bypass authentication and access victims' networks. This vulnerability has raised alarms among cybersecurity experts, particularly Arctic Wolf, who reported on the ongoing exploitation. Organizations using Palo Alto Networks' GlobalProtect VPN are at risk, as the attackers can infiltrate systems without proper credentials. This situation emphasizes the urgency for affected companies to address the vulnerability and safeguard their networks to prevent ransomware attacks, which can result in data loss and significant downtime. Users are advised to stay vigilant and apply any available security updates promptly.

Researchers from Palo Alto Networks Unit 42 have reported that a Chinese-speaking advanced persistent threat group, tracked as CL-STA-1062, has been targeting government and energy networks in Southeast Asia. This group has been active since at least March 2022 and has recently intensified its operations in the region, employing custom malware known as TinyRCT to exploit vulnerabilities in critical infrastructure. The focus on Southeast Asia raises concerns about the security of essential services and the potential for significant disruptions. As these attacks target vital sectors, governments and organizations in the region need to bolster their cybersecurity defenses to mitigate risks posed by such sophisticated threats.

Palo Alto Networks has issued a warning regarding a serious, unpatched vulnerability in the User-ID Authentication Portal of its PAN-OS. This flaw, categorized as a remote code execution (RCE) vulnerability, is currently being exploited in real-world attacks, putting users at significant risk. Organizations using affected versions of PAN-OS should be particularly vigilant as attackers may leverage this weakness to gain unauthorized access to systems. It's crucial for companies to assess their firewall configurations and implement necessary security measures to protect against potential breaches. The situation underscores the need for prompt action in addressing vulnerabilities as they arise.

Palo Alto Networks has issued a warning about a serious vulnerability in its PAN-OS, identified as CVE-2026-0300, which has a high severity score of 9.3. This flaw, a buffer overflow, allows attackers to execute remote code without authentication, making it particularly dangerous. The company reports that this vulnerability is currently being exploited in the wild, putting numerous users at risk. Organizations that rely on PAN-OS should prioritize addressing this vulnerability to prevent unauthorized access and potential system compromise. Immediate action is critical to mitigate the risks associated with this active threat.