Qilin ransomware weaponizes Palo Alto GlobalProtect flaw (CVE‑2026‑0257) to breach networks
Arctic Wolf uncovered a wave of June 2026 intrusions where attackers used CVE‑2026‑0257, an authentication bypass in Palo Alto’s GlobalProtect VPN, to gain footholds and launch Qilin ransomware. The flaw lets unauthenticated users tunnel into firewalls, and affiliates quickly pivot to domain‑wide encryption, exposing any org still on pre‑patch versions.