DanSec

Vendor

Palo Alto Networks

In 34 briefs, most recently 31 October 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Known exploited (CISA KEV)

16 Palo Alto Networks vulnerabilities are on CISA's list of vulnerabilities exploited in the wild, 6 of them used in ransomware campaigns. Most recent:

Coverage in DanSec Daily

  1. Chainalysis breach, malicious Claude Code extension on Cursor exposing developers, and Ivanti Connect Secure root-access exploit chain.
  2. Binance's $6.3B heist tied to TraderTraitor, Polymarket supply-chain hack, and critical CVEs in GitLab and Cisco SD-WAN exploited in the wild.
  3. Quest Diagnostics and Capcom breaches, LiteLLM master key leak, and unpatched PHP2Shell RCE drawing Mirai botnet exploitation attempts.
  4. Quest Diagnostics patient data breach, Capcom's 11.7M-record exposure, and PHP2Shell RCE with no patch, plus Brotli and ArubaOS flaws.
  5. Lazarus Group's FlashHole watering-hole campaign, Tor exit relay hijacking, and Zeabur's second breach in two months.
  6. Covers the UK Legal Aid Agency and CenterPoint Energy breaches, Ivanti and Cisco zero-days under exploitation, and GhostAction compromising about 1,900 GitHub …
  7. WordPress wp2shell webshell attacks, Microsoft SharePoint RCE exploitation, and Anubis ransomware targeting Coca-Cola's Fairlife.
  8. KDDI breach hits 12M people, AssuranceAmerica exposes 6.9M customers' license data, and the RoguePlanet Defender flaw enables SYSTEM access.
  9. Infinite Campus school data theft by ShinyHunters, Tchap breach of French government accounts, and PAN-OS GlobalProtect exploitation.
  10. ShinyHunters hit Oracle PeopleSoft and Nottingham University; Ivanti Sentry flaw exploited; Microsoft's record 206-flaw Patch Tuesday.
  11. The Dashlane vault breach, the Miasma npm supply chain attack on Red Hat packages, and active exploitation of Windows Netlogon CVE-2026-41089 and Palo Alto …
  12. Active exploitation of PAN-OS GlobalProtect flaw CVE-2024-3400, a claimed MyPillow hack, and the CIFSwitch Linux kernel root escalation.
  13. Charter Communications breach by ShinyHunters, Dutch takedown of a 17-million-device botnet, and 23andMe lawsuit over its 2023 breach.
  14. The Foxconn ransomware breach, Fragnesia Linux kernel root exploit, and NGINX unauthenticated RCE flaw, plus Microsoft's May Patch Tuesday fixes.
  15. ShinyHunters breach of Instructure's Canvas disrupts colleges; RansomHouse claims Trellix breach; Daemon Tools supply chain attack contained.
  16. Canvas/Instructure breach exposing up to 275M students, DAEMON Tools supply chain backdoor, and a zero-day in Palo Alto PAN-OS firewalls.
  17. DAEMON Tools supply chain backdoor, ShinyHunters' Vimeo breach, and a claimed 280M-record Instructure theft lead this cybersecurity news brief.
  18. Eurail breach exposing 300,000+ passport records, ChipSoft ransomware shutdown, and Smart Slider 3 Pro backdoored update supply chain attack.
  19. LeakBase admin arrest, HackerOne employee data breach via Navia, and Microsoft 365 device code phishing hitting 340+ organizations.
  20. Grubhub and Central Maine Healthcare breaches, Microsoft-led RedVDS takedown, and a Cisco Secure Email Gateway zero-day exploited by China-linked APTs.
  21. The University of Sydney breach, Denmark water utility attack attributed to Russia, and actively exploited WatchGuard Fireware VPN flaw CVE-2025-14733.
  22. Ferry malware arrests in France, E-Note crypto exchange seizure, HPE OneView CVE-2025-37164 RCE, and Kimsuky's $2B crypto theft in 2025.
  23. React2Shell RCE exploited in breaches at 30 organisations, Kohler smart toilet camera encryption flaws, and 30+ AI IDE vulnerabilities.
  24. Salesforce OAuth data access via Gainsight, Italy's FS Italiane breach through Almaviva, and Operation WrtHug compromising 50,000+ Asus routers.
  25. The Ribbon Communications breach, Cisco IOS XE webshell attacks, the Motex Lanscope zero-day exploited by Tick, and Conti extradition news.
  26. SonicWall SSL VPN compromises across 100+ environments, Oracle EBS zero-day malware attacks, and FBI seizure of BreachForums domains tied to ShinyHunters.
  27. FBI seizes BreachForums amid ShinyHunters Salesforce extortion; Gladinet CentreStack zero-day CVE-2025-11371 and Oracle EBS zero-day attacks actively exploited.
  28. Discord third-party support data breach, CometJacking attack on Perplexity's Comet browser, and surge in scans against Palo Alto Networks logins.
  29. Harrods and Jaguar Land Rover breaches, Asahi's cyberattack, and Akira ransomware exploiting SonicWall VPNs.
  30. Jaguar Land Rover cyberattack disrupts operations, Workiva breach via Salesforce CRM, and Salesloft/Drift fallout hits Cloudflare, Palo Alto Networks and …
  31. Salesloft Drift OAuth breach hits Cloudflare, Palo Alto Networks and Zscaler; Jaguar Land Rover cyberattack halts production; WhatsApp zero-day exploited …
  32. Covers the TransUnion breach (4.4M people), MathWorks ransomware theft, and the Nx npm supply chain attack that leaked 2,300+ credentials via AI-powered …
  33. ShinyHunters vishing breaches at Qantas, Allianz Life and Adidas; SafePay claims 3.5TB Ingram Micro theft; Microsoft SharePoint mass exploitation hits South …
  34. FortiGate read-only access after patching, Paper Werewolf's PowerModul implant, and PAN-OS GlobalProtect brute-force attacks.