Cyber Security News

Hacking Editorial Brief — October 27, 2026

Ransomware Operators Exploit Zero-Day PAN-OS Vulnerability to Target VPN Access

Ransomware groups including Qilin and INC are actively exploiting PAN-OS vulnerability CVE-2026-0257 to bypass authentication and gain unauthorized VPN access, according to Unit 42 researchers at Palo Alto Networks. The authentication bypass flaw, disclosed in May 2026, is now being weaponized in intrusion campaigns targeting organizations running vulnerable firewall configurations. The exploitation enables attackers to establish initial access without valid credentials, though the full scope of affected organizations and successful compromises has not been disclosed. Separately, researchers report that attackers are exploiting a third Arista VeloCloud Orchestrator zero-day (CVE-2026-114625) in four months, a critical SQL injection flaw that Arista Networks has now patched. The sustained targeting of VeloCloud infrastructure suggests continued attacker interest in SD-WAN platforms as an intrusion vector.

Japan's GMO Internet Warns Customers to Disconnect Systems Ahead of Threatened Ransomware Attack

GMO Internet Group issued an unprecedented warning to customers to back up data and disconnect computers after threat actors demanded $50-51 million and threatened to deploy ransomware and leak customer information. The warning follows a breach of GMO's virtual desktop cloud service used for foreign exchange trading, with attackers claiming to have published customer data after ransom demands were not met. GMO's CEO publicly acknowledged the service had security vulnerabilities the company was slow to remediate. The scope of data exposure, number of affected customers, and verification of attacker claims remain unclear. Separately, threat actors reportedly breached Australian booking management provider RMS Cloud, affecting multiple holiday parks and customer data, and claimed access to crisis communications firm Sodali, though the extent of these compromises has not been independently verified. Researchers also observed threat actors exploiting Magento CMS blocks to inject JavaScript into compromised storefronts while evading malware detection, and attempting mass exploitation of PHP2Shell vulnerabilities to deploy Mirai botnet variants.

Sources: Unit 42 Palo Alto Networks · SecurityWeek · Bloomberg · The Register · Japan Times · ABC News · GBHackers · The Hacker News