Unit 42 https://unit42.paloaltonetworks.com/ Palo Alto Networks Mon, 09 Nov 2026 15:15:05 +0000 en-US hourly 1 https://wordpress.org/?v=7.1.4 https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-Unit42-180x180-1.png Unit 42 https://unit42.paloaltonetworks.com/ 32 32 noPalo Alto Networks Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration Systems https://unit42.paloaltonetworks.com/europes-refrigeration-systems-attacks/ Fri, 06 Nov 2026 21:15:09 +0000 https://unit42.paloaltonetworks.com/?p=189049 Unit 42 examines recent cyberattacks targeting European refrigeration systems and outlines defense and mitigation strategies.

The post Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration Systems appeared first on Unit 42.

]]> 4 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/11/06_Myth-Busting_Category_1505x922-300x300.jpg 4 Unit 42 examines recent cyberattacks targeting European refrigeration systems and outlines defense and mitigation strategies. The post Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration Systems appeared first on Unit 42.Unit 42 examines recent cyberattacks targeting European refrigeration systems and outlines defense and mitigation strategies. The post Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration Systems appeared first on Unit 42.Hospitality Hacks and Retail Reality Checks, Insights Unit 42 Threat Intelligence Highlights - Nov. 2, 2026 https://unit42.paloaltonetworks.com/u42-threat-intelligence-highlights-oct-2026/ Mon, 02 Nov 2026 23:00:45 +0000 https://unit42.paloaltonetworks.com/?p=189038 Unit 42 details recent threat intelligence, highlighting cyberespionage, financial extortion, and the rapid adoption of AI across offensive workflows.

The post Unit 42 Threat Intelligence Highlights - Nov. 2, 2026 appeared first on Unit 42.

]]> 2 https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/05_Interview_Category_1505x922-300x300.jpg 2 Unit 42 details recent threat intelligence, highlighting cyberespionage, financial extortion, and the rapid adoption of AI across offensive workflows. The post Unit 42 Threat Intelligence Highlights - Nov. 2, 2026 appeared first on Unit 42.Unit 42 details recent threat intelligence, highlighting cyberespionage, financial extortion, and the rapid adoption of AI across offensive workflows. The post Unit 42 Threat Intelligence Highlights - Nov. 2, 2026 appeared first on Unit 42.General, Insights, AI, cyber espionage, Extortion, threat intelligence Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/ Thu, 29 Oct 2026 18:00:34 +0000 https://unit42.paloaltonetworks.com/?p=188799 CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.

The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) appeared first on Unit 42.

]]> 8 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/03_Vulnerabilities_1920x900-300x300.jpg 8 CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) appeared first on Unit 42.CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) appeared first on Unit 42.High Profile Threats, Vulnerabilities, CVE-2026-109618, CVE-2026-109619, PHP2Shell Unwrapping Retail Peak Season Cyber Threats https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/ Wed, 28 Oct 2026 18:00:10 +0000 https://unit42.paloaltonetworks.com/?p=189023 Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust.

The post Unwrapping Retail Peak Season Cyber Threats appeared first on Unit 42.

]]> 6 https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/07_Listicle_Category_1505x922-300x300.jpg 6 Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust. The post Unwrapping Retail Peak Season Cyber Threats appeared first on Unit 42.Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust. The post Unwrapping Retail Peak Season Cyber Threats appeared first on Unit 42.Hospitality Hacks and Retail Reality Checks, Insights, data exfiltration, Frontier AI, Retail EMudhra Intermediate CA Certificates Compromised https://unit42.paloaltonetworks.com/emudhra-certificate-compromise/ Thu, 22 Oct 2026 17:15:32 +0000 https://unit42.paloaltonetworks.com/?p=188944 Eight compromised eMudhra intermediate CA private keys risk unauthorized TLS signing and MitM interception. Read our analysis and containment guide.

The post EMudhra Intermediate CA Certificates Compromised appeared first on Unit 42.

]]> 4 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/07_Security-Technology_Category_1920x900-1-300x300.jpg 4 Eight compromised eMudhra intermediate CA private keys risk unauthorized TLS signing and MitM interception. Read our analysis and containment guide. The post EMudhra Intermediate CA Certificates Compromised appeared first on Unit 42.Eight compromised eMudhra intermediate CA private keys risk unauthorized TLS signing and MitM interception. Read our analysis and containment guide. The post EMudhra Intermediate CA Certificates Compromised appeared first on Unit 42.High Profile Threats, Malware, certificates, Compromise, cryptographic, MitM, PKI, TLS The Current Landscape of OAuth Attacks https://unit42.paloaltonetworks.com/current-landscape-oauth-attacks/ Thu, 22 Oct 2026 17:00:25 +0000 https://unit42.paloaltonetworks.com/?p=188831 Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments.

The post The Current Landscape of OAuth Attacks appeared first on Unit 42.

]]> 13 https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/03_Resize_Myth-Busting_Overview_1920x900-300x300.jpg 13 Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments. The post The Current Landscape of OAuth Attacks appeared first on Unit 42.Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments. The post The Current Landscape of OAuth Attacks appeared first on Unit 42.General, Insights, AI, credential-based attacks, MFA “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/ Wed, 21 Oct 2026 14:00:24 +0000 https://unit42.paloaltonetworks.com/?p=188690 An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration.

The post “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities appeared first on Unit 42.

]]> 11 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/AdobeStock_1246251272-2-1-300x300.jpg 11 An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration. The post “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities appeared first on Unit 42.An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration. The post “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities appeared first on Unit 42.Malware, Threat Research, API, data exfiltration, DeepSeek, Hermes Agent, payload, Telecoms, VoIP fraud, WordPress Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/ Tue, 20 Oct 2026 20:30:42 +0000 https://unit42.paloaltonetworks.com/?p=182026 Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257.

The post Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) appeared first on Unit 42.

]]> 5 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/07_Vulnerabilities_1920x900-300x300.jpg 5 Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) appeared first on Unit 42.Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) appeared first on Unit 42.High Profile Threats, Vulnerabilities, CVE-2026-0257, vulnerability Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 https://unit42.paloaltonetworks.com/top-5-initial-access-vectors-september-2026/ Fri, 16 Oct 2026 17:47:54 +0000 https://unit42.paloaltonetworks.com/?p=188674 Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing

The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42.

]]> 2 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Myth-Busting_Overview_1920x900-300x300.jpg 2 Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42.Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42.General, Insights, Trend Reports, Initial Access, threat intelligence, trends AI-Powered Espionage Campaign Targets Government Linux Infrastructure https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ Thu, 15 Oct 2026 22:00:09 +0000 https://unit42.paloaltonetworks.com/?p=188392 Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft.

The post AI-Powered Espionage Campaign Targets Government Linux Infrastructure appeared first on Unit 42.

]]> 18 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/AdobeStock_637057734-300x300.jpg 18 Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft. The post AI-Powered Espionage Campaign Targets Government Linux Infrastructure appeared first on Unit 42.Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft. The post AI-Powered Espionage Campaign Targets Government Linux Infrastructure appeared first on Unit 42.Malware, Threat Research, exfiltration, LLM, network security, payload, Python, Remote Access Trojan, reverse shells, web shells Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/ Wed, 14 Oct 2026 22:00:44 +0000 https://unit42.paloaltonetworks.com/?p=188095 We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware.

The post Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant appeared first on Unit 42.

]]> 14 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/09_Vulnerabilities_1920x900-300x300.jpg 14 We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware. The post Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant appeared first on Unit 42.We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware. The post Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant appeared first on Unit 42.Malware, Threat Research, Apache, CL-STA-0954, logging, network intrusion, Network Sniffer, payload, reverse shells, VPN The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/ Tue, 13 Oct 2026 22:00:04 +0000 https://unit42.paloaltonetworks.com/?p=188247 Unit 42 dissects a cyberattack targeting a European bank's IT infrastructure, delivering concrete defense strategies to help organizations detect and counter comparable threats.

The post The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk appeared first on Unit 42.

]]> 3 https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/07_Listicle_Category_1505x922-300x300.jpg 3 Unit 42 dissects a cyberattack targeting a European bank's IT infrastructure, delivering concrete defense strategies to help organizations detect and counter comparable threats. The post The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk appeared first on Unit 42.Unit 42 dissects a cyberattack targeting a European bank's IT infrastructure, delivering concrete defense strategies to help organizations detect and counter comparable threats. The post The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk appeared first on Unit 42.Anatomy of an Attack, Insights, credential-based attacks, incident response, Reconnaissance Evolution of Web3 in Cloud Supply Chain Attacks https://unit42.paloaltonetworks.com/web3-cloud-supply-chain-attacks/ Wed, 07 Oct 2026 22:00:16 +0000 https://unit42.paloaltonetworks.com/?p=187943 Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments

The post Evolution of Web3 in Cloud Supply Chain Attacks appeared first on Unit 42.

]]> 8 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/10_Myth-Busting_Category_1505x922-300x300.jpg 8 Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments The post Evolution of Web3 in Cloud Supply Chain Attacks appeared first on Unit 42.Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments The post Evolution of Web3 in Cloud Supply Chain Attacks appeared first on Unit 42.General, Insights, cloud configuration, DPRK, supply-chain attack, Web3 Blinder Tunnel Campaign Targets Iraqi Infrastructure https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/ Tue, 06 Oct 2026 10:00:33 +0000 https://unit42.paloaltonetworks.com/?p=187630 Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure.

The post Blinder Tunnel Campaign Targets Iraqi Infrastructure appeared first on Unit 42.

]]> 23 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/05_Malware_Category_1920x900-1-300x300.jpg 23 Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure. The post Blinder Tunnel Campaign Targets Iraqi Infrastructure appeared first on Unit 42.Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure. The post Blinder Tunnel Campaign Targets Iraqi Infrastructure appeared first on Unit 42.Malware, Threat Research, Advanced Persistent Threat, Agent Serpens, AppDomainManager, GitHub, Iran, payload Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ Wed, 30 Sep 2026 20:00:04 +0000 https://unit42.paloaltonetworks.com/?p=187874 Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild.

The post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) appeared first on Unit 42.

]]> 9 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/06_Vulnerabilities_1920x900-5-300x300.jpg 9 Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. The post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) appeared first on Unit 42.Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. The post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) appeared first on Unit 42.High Profile Threats, Vulnerabilities, Citrix, CVE-2026-88771, CVE-2026-88772, denial of service, Remote Code Execution, zero-day