The Palo Alto VPN vulnerability CVE-2026-0257 allows unauthenticated attackers to forge authentication override cookies and bypass GlobalProtect completely. Rapid7 confirmed active exploitation from May 17, 2026. CISA listed it in the KEV catalog. Patch all firewalls now.

The PeopleSoft zero-day CVE-2026-35273 let ShinyHunters achieve unauthenticated remote code execution against more than 100 organizations weeks before Oracle's patch existed. Security teams must patch immediately and hunt for signs of prior compromise.

The RoguePlanet exploit targets Microsoft Defender’s malware scanning engine and can lead to SYSTEM-level access on patched Windows systems. Microsoft tracks the issue as CVE-2026-50656 and is working on a security update. Organisations should restrict disk image mounting, enable ASR rules, strengthen allowlisting, and monitor for suspicious Defender-related process activity.

The Splunk Enterprise vulnerability CVE-2026-20253 lets unauthenticated attackers achieve remote code execution on fully unpatched SIEM deployments and is actively exploited in the wild. Patch to version 10.2.4 or 10.0.7 immediately or take vulnerable instances offline now.

The FortiBleed attack exposed working admin passwords for 86,644 Fortinet FortiGate firewalls across 194 countries. CISA confirms active exploitation. Reset all credentials and enable MFA right now.

The Velociraptor attack weaponises legitimate tools including Cloudflare tunnels, Zoho Assist, and VS Code SSH to maintain hidden access inside hacked networks. Microsoft DART and Huntress confirm active attacks. Hunt for indicators and patch SolarWinds WHD now.