Loading story…
Palo Alto Networks has become the first major SASE/SSE vendor to publicly admit that Secure Web Gateways (SWGs) are architecturally unable to defend against Last Mile Reassembly attacks. These attacks, first disclosed by SquareX, allow malware to bypass proxy inspection and reassemble within the browser, evading traditional security controls. The acknowledgment marks a significant shift in industry perspective, highlighting the need for browser-native security solutions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcesecuritysenses.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed a **critical vulnerability** in Secure Email Gateway appliances running affected `AsyncOS` versions when inbound mail rules use **File Analysis** (`Cisco AMP`) or **Content Filter** features and the bundled **Content Scanner Tools** are older than `23.3.0.4823`. Successful exploitation can let an attacker overwrite files at the operating-system level, enabling **root-level account creation**, configuration changes, arbitrary code execution, and denial of service. Cisco released software updates and said no alternative mitigations are available. Palo Alto Networks also issued fixes for a **serious PAN-OS management interface flaw** that allows an unauthenticated attacker to execute certain PHP scripts and affect the **integrity and confidentiality** of the firewall, though the vendor said it does not permit arbitrary remote code execution. Exploitation attempts have already been observed and proof-of-concept code is public, increasing urgency for exposed management interfaces. Palo Alto said **Cloud NGFW** and **Prisma Access** are not affected, while `PAN-OS 11.0` is out of support and will not receive a patch.
Jun 29, 2026
Palo Alto Networks released security advisories for multiple **PAN-OS** branches after disclosing several serious flaws, including `CVE-2026-0265`, an authentication bypass caused by a signature verification weakness when **Cloud Authentication Service (CAS)** is enabled and attached to a login interface. The issue affects **PA-Series**, **VM-Series**, and **Panorama** deployments, while **Cloud NGFW** and **Prisma Access** are not affected. Palo Alto also warned of a heap-based buffer overflow in the DNS Proxy and DNS Server that could enable unauthenticated remote code execution, as well as a separate remote code execution flaw in **IKEv2** processing across supported releases including 12.1, 11.2, 11.1, and 10.2. The Canadian Centre for Cyber Security urged administrators to review Palo Alto’s advisories, apply mitigations, and install updates, with fixes already issued for many affected versions and additional patches expected for some branches. Rapid7 said organizations using CAS should prioritize emergency patching rather than depend on workarounds, while researcher Harsh Jaiswal of HacktronAI publicly claimed successful exploitation of the authentication bypass against multiple companies’ **GlobalProtect** portals to obtain VPN access; Palo Alto had not confirmed in-the-wild exploitation as of May 14.
Jul 23, 2026Palo Alto Networks disclosed **CVE-2026-0300**, a critical `CWE-787` out-of-bounds write in the PAN-OS User-ID Authentication Portal, also known as the Captive Portal, that allows an unauthenticated attacker to achieve remote code execution as **root** on affected **PA-Series** and **VM-Series** firewalls. The flaw was reported as actively exploited in the wild and added to CISA's **Known Exploited Vulnerabilities** catalog, with exploitation observed against portals reachable from untrusted networks or the public internet. Palo Alto said **Prisma Access**, **Cloud NGFW**, and **Panorama** are not affected, while vulnerable PAN-OS branches included 10.2, 11.1, 11.2, and 12.1 below fixed releases. Reporting on observed intrusions said attackers used the firewall access for shellcode injection into `nginx` worker processes, credential extraction, Active Directory enumeration, outbound tunneling with tools such as **EarthWorm** and **ReverseSocks5**, internal pivoting, and anti-forensic log cleanup. Palo Alto began releasing patches in staged waves and urged defenders to disable the Captive Portal if unused or restrict it to trusted IPs and zones, enable available threat-prevention signatures, and treat previously exposed devices as potentially fully compromised by auditing configurations, checking admin accounts and SSH keys, rotating credentials, and monitoring for persistence or suspicious outbound connections.
Jun 29, 2026