Weekly security report tracks VPN abuse, container escape and malware
Security researchers have reported active exploitation of CVE-2026-0257, an authentication-bypass flaw in PAN-OS GlobalProtect and Prisma Access, by the Qilin and Settra ransomware groups. The issue was disclosed in May 2026, and ReliaQuest warned that access through an organisation's own VPN can blend in with legitimate remote-working traffic.
The same weekly roundup details CVE-2026-47595, or Bad UVM, in NVIDIA's GPU Display Driver for Linux. The vulnerability carries a CVSS score of 7.5 and could allow an unprivileged local user to write to read-only memory, leading to code execution, privilege escalation, denial of service, information disclosure, data tampering and a container escape.
Trusted access and infrastructure remain high-value targets
ReliaQuest said patching PAN-OS alone may not remove access obtained before remediation. It advised affected organisations to upgrade deployments, disable authentication override cookies where they are unnecessary, terminate all active GlobalProtect sessions after patching, and investigate unexpected connections, including sessions using hostnames such as “kali”.
The warning fits a continuing pattern in which trusted access paths can conceal malicious activity: familiar security assumptions becoming attack entry points examines how familiar security assumptions can become an entry point, while the current cases show why authentication events and post-login behaviour need separate scrutiny.
For Bad UVM, researcher Ziyi Guo described injecting exploit code into nvidia-persistenced to force a UVM-based local privilege escalation. After crossing that barrier, the technique can execute commands on the host with full root access. The finding is particularly important to teams operating Linux workloads that combine GPU drivers with containerised applications.
RCE chains, cloud credentials and persistent malware
Several other disclosures underline the breadth of the exposure. A chain of four flaws in the cloud version of Adobe Experience Manager combines unauthenticated DAM bulk import, stored cross-site scripting, unsafe XML parsing and Groovy execution via /bin/asynccommand to enable unauthenticated remote code execution. Adobe has patched the affected cloud service.
Harbor also addressed GHSA-2phj-cp9f-qq6w, an SSRF vulnerability with a CVSS score of 8.5. A registered user able to create a project could point a webhook at a cloud metadata endpoint and obtain the server's IAM credentials. NSD, meanwhile, patched four high-severity flaws in version 4.15.3 or newer that could permit arbitrary command execution.
Wordfence described a WordPress must-use plugin backdoor with self-healing mechanisms and EtherHiding, which uses an Ethereum smart contract to conceal attacker server locations. The malware can create and hide administrator access, collect administrator passwords, alter sites remotely, exfiltrate data and spread to other WordPress installations on the file system.
Operational response must include a look back
The report's common operational lesson is that a fixed vulnerability is not necessarily a resolved incident. Teams should prioritise patching exposed products, terminate or rotate sessions and credentials where appropriate, review anomalous VPN and administrator activity, and assess persistence on systems that may have been reachable before remediation. That approach helps businesses determine not only what was vulnerable, but whether access was established and remains available to an attacker.