HIGHRansomware
Global

Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)

·Source: Unit 42 (Palo Alto)

Updated:

Executive Summary

Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19) appeared first on Unit 42 .

Analysis

Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19) appeared first on Unit 42 .

Indicators of Compromise (1)

CVE (1)
CVE-2026-0257
NVDMITRE CVE
Source Attribution

Originally published by Unit 42 (Palo Alto) on Oct 19, 2026.

Related Threats

HIGHRansomware

Cybercrime crackdown across Africa leads to 1,462 arrests, $105 million seized

More than 1,400 suspected cybercriminals were arrested across Africa this summer as part of a crackdown on the gangs perpetrating online fraud, ransomware and business email compromise attacks, Interpol said.

The Record
HIGHRansomware

Authorities disrupt nearly 11,000 cybercrime networks in Africa

Law enforcement agencies have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people in Operation Serengeti III, which targeted business email compromise, ransomware, and online scams. [...]

BleepingComputer
HIGHRansomware

US, UK and Germany Warn of Active SafePay Ransomware

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/us-uk-germany-warn-active-safepay-ransomware-image_small-10-a-33164.jpg" align=right hspace=4><b>Vertically Integrated Double-Extortion Group Hacks 13 Victims in 12 Days</b><br>U.S., U.K. and German agencies warned that SafePay ransomware has compromised at least 600 organizations since August 2024, exploiting VPN, firewall and ba

Bank Info Security