{
  "id": 15778879,
  "title": "Palo Alto's firewall OS has been under attack from multiple ransomware groups since June",
  "url": "https://urgent.news/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-15778879",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-20T17:33:26.000Z",
  "source": {
    "name": "The Register",
    "slug": "the-register",
    "url": "https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/5304226"
  },
  "original_language": "en",
  "account": "Since June, multiple ransomware groups, such as Qilin and Inc, have been targeting Palo Alto Networks' PAN-OS firewall operating system with a high-severity authentication bypass bug, according to security firm Unit 42. Unit 42 has been monitoring attacks across various industries, including finance, healthcare, and manufacturing. The vulnerability, CVE-2026-0257, affects GlobalProtect portals and gateways, potentially enabling unauthorized VPN connections. Initially rated as medium severity, the issue was quickly deemed exploitable, with successful exploitation observed by May 17. Unit 42's Andy Piazza warns that attackers exploit this vulnerability to gain an initial foothold, bypass multi-factor authentication, and establish VPN sessions. They then move laterally across networks, dropping additional malware for credential harvesting and data theft before deploying ransomware. Remediation is crucial, and Unit 42 advises organizations to check for infection indicators and investigate potential network access by the attackers.",
  "summary": "Unit 42 investigates network compromises across numerous industries",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register Science",
        "title": "Palo Alto's firewall OS has been under attack from multiple ransomware groups since June",
        "url": "https://urgent.news/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware",
        "published": "2026-10-20T17:33:26.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}