2026-05-06: Palo Alto Networks firewalls face active zero-day exploitation targeting exposed authentication

Show Notes - 2026-05-06

Stories Covered

• Today:
• Palo Alto Networks PAN-OS Zero-Day Exploited (CVE-2026-0300) [Critical Alerts]
• Apache HTTP Server Double-Free Leads to DoS and RCE (CVE-2026-23918) [Critical Alerts]
• Android Critical RCE Patched (CVE-2026-0073) [Critical Alerts]
• Karakurt Ransomware Negotiator Sentenced to 8.5 Years [Ransomware & Extortion]
• CloudZ RAT Abuses Windows Phone Link to Steal OTPs [Ransomware & Extortion]
• DAEMON Tools Supply Chain Attack Delivers Signed Backdoor [Business & Infrastructure Threats]
• Microsoft Warns of Sophisticated AiTM Phishing Campaign [Business & Infrastructure Threats]
• Microsoft Edge Stores All Passwords in Cleartext Memory [Business & Infrastructure Threats]
• OAuth Grants Create Persistent Backdoor in Enterprise Environments [Business & Infrastructure Threats]
• MetInfo CMS Remote Code Execution Exploited (CVE-2026-29014) [Business & Infrastructure Threats]
• Google Expands Binary Transparency for Android Apps [General Security News]
• Quasar Linux Malware Targets Software Developers [General Security News]
• DarkSword iOS Exploit Chain [General Security News]
• Trellix Source Code Breach [General Security News]
• Instructure Breach Claims 280M Records [General Security News]
• Copy Fail Linux Kernel Vulnerability (CVE-2026-31431) [Vulnerability Disclosures]
• ICS Vulnerabilities [Vulnerability Disclosures]
• SSL.com Root Certificate Rotation [Vulnerability Disclosures]
• Microsoft CVE Disclosures [Vulnerability Disclosures]

CVEs Referenced

CVE-2018-1002208, CVE-2024-43093, CVE-2024-50302, CVE-2025-11043, CVE-2025-38352, CVE-2025-48543, CVE-2026-0073, CVE-2026-0300, CVE-2026-0936, CVE-2026-21661, CVE-2026-23918, CVE-2026-29014, CVE-2026-31431, CVE-2026-43037, CVE-2026-43964

Indicators of Compromise

Domains: daemontools[.]cc, daemontools[.]cc.

Read the full brief