Summary
Attackers are slipping past VPN defenses by exploiting a flaw in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access, blending their unauthorized access with legitimate remote-work traffic. Cyware highlights how this authentication bypass, tracked as CVE-2026-0257, is already being used in the wild to target organizations running PAN-OS 12.1, 11.2, 11.1, and 10.2, as well as Prisma Access 11.2 and 10.2.
A single print job can now bring entire office workflows to a halt, as a bug in OpenPrinting CUPS (CVE-2026-107888) lets unprivileged users crash the print service for everyone. The flaw, patched in CUPS 2.4.20, exposes shared print infrastructure to denial-of-service attacks that disrupt multiple users and dependent services.
Top Vulnerabilities Reported in Last 24 hours
Ransomware crews slip into networks via Palo Alto VPNs
Ransomware groups are exploiting an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access (CVE-2026-0257) to establish unauthorized VPN sessions that can look like normal remote-work traffic. The weakness stems from authentication override cookies that can be accepted without proper validation, giving attackers a stealthy path to access internal resources and set the stage for credential theft, lateral movement, and ransomware deployment. Attackers are already exploiting this in the wild. The affected releases listed include PAN-OS 12.1, 11.2, 11.1, and 10.2, plus Prisma Access 11.2 and 10.2. A fix is available via vendor updates, and some defenders are also choosing to disable authentication override cookies when unnecessary, rotate to a new certificate dedicated to those cookies, and investigate endpoints with suspicious hostnames (for example, “kali”) after unusual VPN connections.
CUPS printing bug can take down queues
A flaw in OpenPrinting CUPS (CVE-2026-107888) can let an unprivileged user crash printing by triggering a NULL pointer dereference that terminates the cupsd process, interrupting all print queues it manages. The crash can occur when a job marked “job-held-on-create” points to a temporary printer that has been automatically deleted: cleanup can remove the destination without canceling held jobs, and then cupsdCheckJobs() ends up dereferencing the NULL result returned by cupsdFindDest() while checking holding_new_jobs. In some scenarios, an unprivileged user can trigger this to disrupt printing for multiple users and services that depend on shared print infrastructure. No active exploitation at scale is described in the source; the risk presented is availability and operational disruption. A fix is available in CUPS 2.4.20, and if immediate updating is not possible, suggested workarounds include monitoring and manually managing temporary printers to avoid auto-deletion without job cancellation.
Frequently Asked Questions
What is CVE-2026-0257? Ransomware groups are exploiting an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access (CVE-2026-0257) to establish unauthorized VPN sessions that can look like normal remote-work traffic. The weakness stems from authentication override cookies that can be accepted without proper validation, giving attackers a stealthy path to access internal resources and set the stage for credential theft, lateral movement, and ransomware deployment.
What is CVE-2026-107888? A flaw in OpenPrinting CUPS (CVE-2026-107888) can let an unprivileged user crash printing by triggering a NULL pointer dereference that terminates the cupsd process, interrupting all print queues it manages. The crash can occur when a job marked “job-held-on-create” points to a temporary printer that has been automatically deleted: cleanup can remove the destination without canceling held jobs, and then cupsdCheckJobs() ends up dereferencing the NULL result returned by cupsdFindDest() while checking holding_new_jobs.