thehackernews.com
Oct 20, 2026
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
AI-summarised brief · reviewed before publication
Palo Alto Networks reports ongoing exploitation of the patched CVE‑2026‑0257 authentication bypass in PAN‑OS and Prisma Access, used by ransomware groups Qilin (Spikey Scorpius) and Tarnished Scorpius (INC). The flaw allows attackers to establish unauthorized VPN connections, bypass MFA, and pivot to virtualization layers such as vCenter and ESXi hypervisors. Incidents target diverse sectors, including education, finance, healthcare, and government, and have involved credential dumping and backup infrastructure attacks. Palo Alto urges proactive hunting and incident response.
💡 Why It Matters
- · The breach demonstrates how a single authentication flaw can grant attackers deep, persistent access across critical infrastructure, exposing sectors that rely on cloud‑based VPNs and virtualization.
- · This underscores the urgency of zero‑trust MFA enforcement and continuous monitoring for lateral movement.
