2026-05-30: Palo Alto GlobalProtect bypass is now actively exploited with CISA adding CVE-2026-0257 to KEV

Show Notes - 2026-05-30 Stories Covered: - Today: - Gogs Zero-Day Exposes Servers to Remote Code Execution (CVE-2025-8110) (https://www.securityweek.com/gogs-zero-day-exposes-servers-to-remote-code-execution/) - PAN-OS GlobalProtect Authentication Bypass Under Active Exploitation (CVE-2026-0257) (https://thehackernews.com/2026/05/pan-os-globalprotect-authentication.html) - Marimo Post-Exploitation via LLM Agent (CVE-2026-39987) (https://thehackernews.com/2026/05/attackers-use-llm-agent-for-post.html) - Silent Ransom Group Escalates to Physical Intrusions (https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-22-7/) - Russia-Linked GREYVIBE Targets Ukraine with AI-Powered Campaigns (https://thehackernews.com/2026/05/new-russian-linked-greyvibe-targets.html) - The Com Criminal Collective Funds Violence via Cybercrime (https://www.darkreading.com/threat-intelligence/the-com-cyberattacks-violence-sexploitation) - Malicious npm Packages Abuse Dependency Confusion to Profile Environments (https://www.microsoft.com/en-us/security/blog/2026/05/29/33-malicious-npm-packages-abuse-dependency-confusion-profile-developer-environments/) - Malicious Sicoob NuGet Package Steals Brazilian Banking Credentials (https://thehackernews.com/2026/05/malicious-sicoob-nuget-steals-banking.html) - 14 Malicious npm Packages Target AWS and CI/CD Secrets (https://thehackernews.com/2026/05/malicious-sicoob-nuget-steals-banking.html) - TrapDoor Supply Chain Campaign Hits 176 npm Packages (https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-22-7/) - ChatGPT Share Links Abused for Malware Distribution (https://www.bleepingcomputer.com/news/security/chatgpt-share-links-abused-to-host-fake-outage-pages-to-deliver-malware/) - Shadow AI: 2,000+ Vibe-Coded Apps Exposed Corporate Data (https://thehackernews.com/2026/05/what-2000-exposed-vibe-coded-apps.html) - Zapier Nearly Compromised via Multi-Step Exploit Chain (https://www.darkreading.com/vulnerabilities-threats/complex-cloud-integrations-small-errors-compromises) - Dutch Authorities Disrupt 17 Million Device Botnet (https://www.bleepingcomputer.com/news/security/dutch-govt-disrupts-malware-botnet-with-17-million-infected-devices/) - Stark Industries Hosting Network Dismantled (https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-22-7/) - Google Chrome Rolls Out Device Bound Session Credentials (https://www.bleepingcomputer.com/news/security/google-chrome-adds-session-cookie-theft-protection-for-all-users/) - California AG Sues 23andMe Over 2023 Breach (https://www.bleepingcomputer.com/news/security/california-ag-sues-23andme-over-2023-breach-exposing-health-data/) - DDoS-as-a-Service Market Evolves from Scripts to Polished Products (https://www.bleepingcomputer.com/news/security/from-5-attacks-to-botnet-powered-platforms-inside-the-ddos-as-a-service-market/) - Chrome 148 Patches 151 Vulnerabilities (https://www.securityweek.com/chrome-148-update-patches-151-vulnerabilities/) - VS Code Remote SSH Extension Vulnerability (https://www.securityweek.com/in-other-news-trump-mobile-data-breach-fifa-world-cup-phishing-cisa-responds-to-supply-chain-attacks/) - Veeam, Notepad++, Roundcube Patches (https://www.securityweek.com/in-other-news-trump-mobile-data-breach-fifa-world-cup-phishing-cisa-responds-to-supply-chain-attacks/) - CISA Expands KEV Catalog with Supply Chain Attack CVEs (https://www.securityweek.com/in-other-news-trump-mobile-data-breach-fifa-world-cup-phishing-cisa-responds-to-supply-chain-attacks/) - ChatGPhish Vulnerability in ChatGPT Web Summaries (https://thehackernews.com/2026/05/chatgphish-vulnerability-turns-chatgpt.html) - SymJack and TrustFall: AI Coding Agent Attacks (https://thehackernews.com/2026/05/chatgphish-vulnerability-turns-chatgpt.html) - CIFSwitch: Linux Local Root Vulnerability (https://www.sc ...