Daily Cybersecurity News - June 5, 2026

Palo Alto Networks firewalls are under active attack through a PAN OS vulnerability.

CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway that lets unauthenticated attackers forge session cookies and establish unauthorized VPN connections. CVSS 7.8, actively exploited in the wild.

Affects PAN OS versions before 11.1.5 h1, 11.2.4 h4, and 12.1.2 h4 on firewalls and Panorama appliances.

Palo Alto confirmed limited exploitation; Rapid7 observed two attack waves starting May 18 and May 21 across multiple customer environments.

Cisco flagged an unpatched flaw in its Catalyst SD-WAN Manager that attackers are already using for root access.

CVE-2026-20245 lets authenticated attackers with netadmin privileges escalate to root by uploading a crafted file to the system. CVSS 7.8, high severity, zero-day exploitation confirmed.

Attackers can chain it with CVE-2026-20182 or CVE-2026-20127 to gain the required access from unauthenticated entry.

The bug sits in the SD-WAN controller exposed to the internet on many enterprise deployments.

Cisco has not released a patch yet.

Attackers are actively exploiting a flaw in Everest Forms Pro to take over WordPress sites with full control.

CVE-2026-3300 is a remote code execution bug with CVSS 9.8. It lets unauthenticated users run arbitrary code on the server.

The plugin has about 4,000 active installations. Affected sites run the Pro version of Everest Forms on WordPress.

Patch released March 18, publicly disclosed March 30, active exploitation observed from April 13. Only sites using the Complex Calculation feature in their forms are exploitable.

A new supply chain campaign is hitting NPM packages with Rust-written malware called IronWorm.

Attackers compromise developer accounts then inject the malware into popular packages. It steals credentials and uses those to spread further down the chain, like Shai Hulud.

The malware also deploys an eBPF kernel rootkit to hide its processes and uses Tor for C2 communications.

The Rust implementation is fresh. Most prior supply chain hits relied on JavaScript or Python instead.

Campaign has already touched dozens of packages and remains active as of the report.

PCPJack turned 230 compromised cloud servers into a secret SMTP relay network.

They hijacked instances on AWS, Google Cloud, and Azure across the US, Europe, and Asia. Business servers were quietly repurposed as email proxies without obvious malware on disk.

The angle is straightforward reuse of cloud hijacks for proxying. No novel exploit or custom tooling stands out.

Compromised servers stayed active for weeks before detection in multiple regions.

The US military appears to be using GPS signals as a one-way broadcast channel for encrypted key updates to assets worldwide.

A fixed but random-looking field in the civilian GPS message carries what looks like encrypted traffic. Analysts traced the pattern across multiple satellites and concluded it matches a system for pushing crypto keys without two-way comms.

The technique reuses existing GPS infrastructure instead of dedicated channels. It is the kind of low-profile method state actors have favored for decades in signals intelligence.

The pattern has appeared consistently in GPS data since at least 2007, with researchers analyzing nearly two decades of satellite observations totaling over 12 million data points.

Researchers built a working prototype of an AI-powered internet worm.

The worm carries its own LLM and executes it on compromised machines. It spreads by exploiting vulnerabilities and then uses the model to generate new attack commands or payloads on the fly.

This stays a lab demo with no real-world infections reported yet. The design matches early theoretical worm concepts more closely than most modern malware samples.

Bruce Schneier highlighted the prototype in his June 2026 post.