Arctic Wolf Labs investigated multiple intrusions in June that began by exploiting an authentication bypass in Palo Alto Networks PAN-OS and ended in Qilin ransomware. CVE-2026-0257 affects the portal and gateway components and lets an unauthenticated remote attacker establish a VPN session without valid credentials, but only where authentication override cookies are enabled alongside specific certificate configurations. That narrow precondition makes it easy to assume you are unaffected without checking. The flaw is patched. Because it grants VPN access rather than code execution, the intrusions look like ordinary remote logins at the start, which delays detection until ransomware is deployed.
Check Point has rushed out a fix for a critical flaw in its Remote Access VPN, Mobile Access, and Spark firewall products that attackers have been exploiting since May 7. The bug (CVE-2026-50751, rated 9.3) is a logic error in how the software checks certificates, letting an unauthenticated attacker log into the VPN with no password, but only on gateways still using the old IKEv1 key-exchange protocol. So far a few dozen organizations have been hit, and at least one intrusion was tied to an affiliate of the Qilin ransomware gang, which used the access to steal data with Rclone before deploying ransomware. A second, unexploited flaw was also patched.
TrustStrike Labs