Palo Alto zero-day CVE-2026-0322 exploited, CISA orders fixes by October 17

Palo Alto Networks patches exploited PAN-OS zero-day CVE-2026-0322

Palo Alto Networks released fixes for a high-severity PAN-OS remote code execution zero-day, CVE-2026-0322, exploited against firewalls. The flaw, rated 8.6, affects the management interface and lets authenticated attackers with network access run code as root. It impacts PA-Series and VM-Series firewalls, Panorama virtual appliances, and M-Series appliances; Cloud NGFW and Prisma Access are unaffected. Palo Alto confirmed very limited exploitation and recommends restricting management interface access to trusted internal IP addresses. Fixes cover PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2, with a 11.2.16 fix due October 15. CISA added the flaw to its Known Exploited Vulnerabilities catalog, requiring federal civilian agencies to mitigate by October 17.

Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks →

Topics: Zero-day vulnerabilitiesPatch Tuesday & security updates

AdFection campaign used targeted ads to infect Al Jazeera devices with Candiru spyware

Researchers at The Citizen Lab detailed AdFection, the first public technical confirmation of a zero-click mercenary spyware attack delivered through targeted advertising. At least 45 devices at Al Jazeera were targeted in 2024 and 2025 with spyware from Candiru, now rebranded Integrity Labs. Infected devices contacted Discover-Tech ad infrastructure, then a Candiru validator and command-and-control server. Discover-Tech, led by CEO Dekel Boni, presents itself as a legitimate ad firm but its Controlium platform lets partners fingerprint and infect devices when an ad renders. Analysis of nearly four billion bidding records showed ads in over 70,000 apps and 120,000 websites. Google and IAB Europe removed Discover-Tech in early October 2026.

Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab →

Topics: SpywareOnline tracking

FBI seizes 187 laptops in Texas raid on North Korean IT worker farms

The U.S. Department of Justice disrupted the Famous Chollima threat group, arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. In a Texas operation codenamed Lonestar Roundup, the FBI searched 40 residences between September 21 and 25, seizing laptops and KVM devices tracked by CrowdStrike since April 2025. Workers used stolen or fabricated identities, VPNs, and proxies to appear U.S.-based, while American facilitators hosted company-issued laptops. Authorities arrested U.S. nationals Michael James Bostelle and Juan Cecilio Pena Carrillo on wire fraud, money laundering, and identity theft charges. An Ohio indictment describes a scheme running from 2019 to July 2025 that impacted 70 U.S. companies and generated roughly $3 million.

FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested →

Topics: Cybercrime arrestsState-sponsored hacking

Malicious AUR packages impersonating yay and paru ran scripts as root

A threat actor uploaded malicious packages to the Arch User Repository impersonating the yay and paru command-line helpers. The campaign was detected on October 13, with packages uploaded by a user named marchos1as under typosquatted names, including yyay. Community members confirmed the packages combined legitimate upstream code with a malicious install script that executed a remote shell script with root privileges. The AUR team banned the account and removed the packages. Maintainer Andreas Reichel said the payload was fetched through a Wayback Machine URL pointing to a personal repository on the Russian hosting service GitFlic. A separate npm campaign dubbed DirtyBlanket used similar infrastructure, though no link is confirmed. Affected users should assume compromise and remediate immediately.

Fake Arch Linux packages push malware with root privileges →

Topics: Supply chain attacks

KGB RAT malware-as-a-service adds jump scares and fake blue screens

Security researchers Group-IB published an in-depth report on KGB RAT, a remote access trojan advertised on underground forums since late 2025, with infrastructure evidence dating to January 2022. Offered as malware-as-a-service, subscriptions start at $150 per month or $800 annually. Even the cheapest tier includes remote desktop access, file management, webcam and microphone access, keylogging, password recovery, and anti-detection features. It can hijack cryptocurrency transactions by swapping copied wallet addresses. A $500 Network Spreading add-on lets it propagate across networks. Its distinguishing feature is psychological harassment, including screamer functions, jump scares, and forced blue screens of death, which developers call fun settings. Group-IB says this signals comfort weaponizing victim anxiety alongside data theft.

Experts uncover bizarre new malware that spooks users with jump scares and screams →

Topics: Malware & infostealers