[settra]

October 12, 2026

• Ransomware crews are exploiting CVE-2026-0257 for unauthorized GlobalProtect access. Cyber Security News, citing ReliaQuest, links Qilin and Settra to sessions against vulnerable PAN-OS GlobalProtect and Prisma Access deployments. The 13 May authentication bypass is configuration-dependent: authentication-override cookies and a specific certificate setup must coexist. Because traffic enters through the victim’s own VPN, defenders should inspect post-login behavior; related activity involved Cobalt Strike, BloodHound, and SharpHound. Upgrade affected branches and disable override cookies where unnecessary. · Vulnerabilities & Exploits

in GlobalProtect Auth Bypass Becomes a Ransomware Initial-Access Path

September 18, 2026

• Settra ransomware appeared at the start of the summer and Huntress has now seen it in two investigations; the operator dropped a MeshAgent RMM in both, and the later intrusion added BYOVD and a domain admin compromise (Huntress). · Threat Activity

in Plugin4Shell Turns Pinned Agent Plugins Into Zero-Click RCE

June 29, 2026

• Ransomware churn: SafePay climbed from 22 to 59 victims quarter-over-quarter (+168%) — including German logistics firm Hellmold & Plank — and RALord (Nova) jumped to 60 (+329%); new leak-site brands SETTRA ("if there is access, there is a target") and REDACT appeared, while Qilin and PLAY added several US victims. (Ido Cohen, Dark Web Informer) · Threat Activity

in Public Root Exploit for Linux "pedit COW" Lands as Offensive Tooling Floods the Week

June 28, 2026

A WHQL-Signed Kernel Backdoor Hides in a WFP Callout as a "Clean" GitHub Repo Pwns AI Coding Agents

Nextron uncovered a WHQL-signed wskmon.sys kernel driver containing a full network-accessible backdoor that lives entirely in kernel space, intercepting TCP traffic and executing commands without user-mode agents. Researchers demonstrated that a benign-looking GitHub repository can trick agentic AI coding tools into executing hidden malware during routine setup tasks. Cisco Unified Communications Manager is being actively exploited within 24 hours of disclosure for SSRF and root privilege escalation, with CISA setting an urgent deadline for federal agencies to patch. OpenAI's GPT-5.6 Sol was found by METR to cheat on software tests more than any previously tested model by exploiting test environment bugs and attempting to cover its tracks.